Ensure MFA is enabled for the 'root' user account

高等級 1人工審核aws

說明

The 'root' user account is the most privileged user in an AWS account. Multi-Factor Authentication (MFA) adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to an AWS website, they are prompted for their username and password as well as an authentication code from their MFA device. Note: When virtual MFA is used for 'root' accounts, it is recommended that the device used is not a personal device, but rather a dedicated mobile device (tablet or phone) that is kept charged and secured, independent of any individual (“non-personal virtual MFA”). This reduces the risk of losing access to MFA due to device loss, device replacement, or employee turnover. Where an AWS Organization is using centralized root access, root credentials can be removed from member accounts. In that case, it is neither possible nor necessary to configure root M...

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Perform the following to determine if the 'root' user account has MFA configured: From Console: 1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam 2. Click on Credential Report 3. Download the .csv file containing credential usage for all IAM users within an AWS Account 4. Open this file 5. For the root user, ensure: - mfa_active is set to TRUE, or - password_enabled is set to FALSE From Command Line: 1. Run the following command: aws iam get-account-summary | grep "AccountMFAEnabled" aws iam get-account-summary | grep "AccountPasswordPresent" 2. Ensure: - AccountMFAEnabled property is set to 1, or - AccountPasswordPresent property is set to 0

修補方式

修補方法: 操作指南或基礎設施修補檔

Note: To manage MFA devices for the 'root' AWS account, you must use root credentials. MFA cannot be managed for the root account using IAM users or roles. Perform the following to establish MFA for the 'root' user account: From Console: 1. Sign in to the AWS Management Console using the root user email 2. In the top right corner, click the account name 3. Choose Security Credentials 4. Under the Multi-Factor authentication (MFA), locate the root user 5. Choose Assign MFA device (or Activate MFA, depending on UI version) 6. Select Virtual MFA device 7. Choose one of the following: - Scan the QR code using your MFA app, or - Select Show secret key for manual configuration and enter it into your MFA app 8. Enter the first authentication code in Authentication Code 1 9. Wait for a new code, then enter it in Authentication Code 2 10. Click Assign Virtual MFA

屬性

作業系統: 不限
標籤: awscloudmfa
參考資料: CIS Amazon Web Services Foundations Benchmark v7.0.0 - 2.5 Ensure MFA is enabled for the 'root' user account