AWS-IAM-Root-Hardware-MFA

Owned by naveen
Last updated: Jun 07, 2022
2 min read

Severity: Medium

Description: This control ensures hardware multi-factor authentication is enabled for the root account. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the root account be protected with a hardware MFA.

Remediation Steps:

To configure and enable a virtual MFA device for use with your root user:

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. Do one of the following:

    • Option 1: Choose Dashboard, and under Security Status, expand Activate MFA on your root user.

    • Option 2: On the right side of the navigation bar, choose your account name, and choose Security Credentials. If necessary, choose Continue to Security Credentials. Then expand the Multi-Factor Authentication (MFA) section on the page.

  3. Choose Manage MFA or Activate MFA, depending on which option you chose in the preceding step.

  4. In the wizard, choose A hardware MFA device and then choose Next Step.

  5. In the Serial Number box, type the serial number that is found on the back of the MFA device.

  6. In the Authentication Code 1 box, type the six-digit number displayed by the MFA device. You might need to press the button on the front of the device to display the number.

  7. Wait 30 seconds while the device refreshes the code, and then type the next six-digit number into the Authentication Code 2 box. You might need to press the button on the front of the device again to display the second number.

  8. Choose Next Step. The MFA device is now associated with the AWS account.

Important:

  • Changes in account credentials may take up to 4 hours to get reflected in the AWS IAM evaluations

Reference:

Blue Hexagon Proprietary