All checks
Medium
MFA should be enabled for all IAM users
Checks that every IAM user has an MFA device assigned, so a stolen password alone cannot sign in. Users with only access keys are in scope too: for them an Authenticator app or Hardware TOTP token lets a policy require MFA on API calls, though for a workload an IAM role in place of the user is usually the better fix.
- service
- IAM
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Affects another check: If the user has a console password, the same device also clears IAM.5, which asks this only of users with one.
In the console
IAM → Users → the user → Security credentials → Multi-factor authentication (MFA)
- MFA device
- Any type passes: Passkey or Security Key (AWS recommends it), Authenticator app, or Hardware TOTP token
With the AWS CLI
aws iam enable-mfa-device --user-name <user-name> --serial-number <mfa-device-arn> --authentication-code1 <code1> --authentication-code2 <code2>See which of your accounts this check is failing on.
Book a live scan