IAM user does not have MFA (virtual or hardware) enabled Affecting IAM service in AWS


Severity

0.0
medium
0
10
    Severity Framework
    Snyk CCSS
    Rule category
    IAM / Authentication

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    AWS-Well-Architected CIS-Controls CSA-CCM HIPAA ISO-27001 NIST-800-53 PCI-DSS SOC-2
  • Snyk ID SNYK-CC-00158
  • credit Snyk Research Team

Description

Enabling MFA provides increased security as it requires the authenticating principal to possess a device that emits a time-sensitive key (for hardware MFA) and have knowledge of a credential (virtual MFA).

How to fix?

Create an aws_iam_virtual_mfa_device resource in Terraform and attach it to the user in the AWS console.

Example Configuration

resource "aws_iam_virtual_mfa_device" "example" {
  virtual_mfa_device_name = "example"
}