Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Perform the following to determine if a MFA device is enabled for all IAM users having a console password: From Console: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam 2. In the left pane, select Users 3. If the MFA or Password age columns are not visible, click the gear icon in the upper right corner and enable them 4. Ensure that for each user where the Password age column shows a value, the MFA column shows Virtual, U2F Security Key, or Hardware. From Command Line: 1. Run the following command: aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,8 2. The output of this command will produce a table similar to the following: user,password_enabled,mfa_active elise,false,false brandon,true,true rakesh,false,false helene,false,false paras,true,true anitha,false,false 3. For any column having password_enabled set to true , ensure mfa_active is also set to true.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Perform the following to enable MFA: From Console: 1. Sign in to the AWS Management Console and open the IAM console at 'https://console.aws.amazon.com/iam/' 2. In the left pane, select Users. 3. Select the IAM user 4. Choose the Security credentials tab 5. Under Multi-factor authentication (MFA), select Assign MFA device 6. Select Virtual MFA device (or hardware/security key as applicable), then choose Continue 7. Configure the MFA device by: - Scanning the QR code, or - Entering the secret key manually 8. Enter two consecutive authentication codes 9. Select Assign MFA