All checks
Medium
MFA should be enabled for all IAM users that have a console password
Checks that every IAM user with a console password has an MFA device assigned, so a stolen or guessed password alone cannot sign in. A user without a console password is out of scope, so removing the password from someone who does not need the console also clears this finding.
- service
- IAM
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
IAM → Users → the user → Security credentials → Multi-factor authentication (MFA)
With the AWS CLI
aws iam enable-mfa-device --user-name <user-name> --serial-number <mfa-device-arn> --authentication-code1 <code1> --authentication-code2 <code2>See which of your accounts this check is failing on.
Book a demo