Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Perform the following to determine if a MFA device is enabled for all IAM users having a console password: From Console: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam 2. In the left pane, select Users 3. If the MFA or Password age columns are not visible, click the gear icon in the upper right corner and enable them 4. Ensure that for each user where the Password age column shows a value, the MFA column shows Virtual, U2F Security Key, or Hardware. From Command Line: 1. Run the following command: aws iam generate-credential-report aws iam get-credential-report --query 'Content' --output text | base64 -d | cut -d, -f1,4,8 2. The output of this command will produce a table similar to the following: user,password_enabled,mfa_active elise,false,false brandon,true,true rakesh,false,false helene,false,false paras,true,true anitha,false,false 3. For any column having password_enabled set to true , ensure mfa_active is also set to true.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Perform the following to enable MFA: From Console: 1. Sign in to the AWS Management Console and open the IAM console at 'https://console.aws.amazon.com/iam/' 2. In the left pane, select Users. 3. Select the IAM user 4. Choose the Security credentials tab 5. Under Multi-factor authentication (MFA), select Assign MFA device 6. Select Virtual MFA device (or hardware/security key as applicable), then choose Continue 7. Configure the MFA device by: - Scanning the QR code, or - Entering the secret key manually 8. Enter two consecutive authentication codes 9. Select Assign MFA