Incorrect policy used to attempt to enforce MFA

What this check finds

AWS had advised incorrect policies for enforcing MFA which allowed an attacker, if they compromised keys that were protected by this policy, to remove the MFA policy from themselves, or remove the existing MFA device and add their own.

Passing looks like: MFA enforcement policy is correct.

How to fix it

Replace the flawed MFA enforcement policy with the current AWS-recommended version. See AWS documentation for the correct policy: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage.html.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

• HighDeprecated or flawed AWS managed policy in use
• HighIAM role allows assumption from anywhere
• HighIAM role with admin privileges can be assumed by unexpected principals
• HighIAM role with s3 listing and get privileges can be assumed by unexpected principals
• HighIAM user access key has not been rotated in over 180 days
• HighInline policy allows privilege escalation to admin
• HighPrincipal has an attached policy granting administrative access
• MediumExpired SSL/TLS certificate stored in IAM

All IAM checks