User has password login, but not MFA
- Severity
- Medium
- Service
- IAM
- Check ID
- USER_WITH_PASSWORD_LOGIN_BUT_NO_MFA
What this check finds
MFA (multi-factor authentication) helps mitigate user account take-over.
Passing looks like: Console users have MFA enabled.
How to fix it
Enforce MFA for all console users via an IAM policy, and ask each affected user to enroll. CLI to list users without MFA: aws iam list-virtual-mfa-devices --assignment-status Unassigned.
AWS console
IAM → Users → select user → Security credentials → Assigned MFA device → Manage.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| CIS AWS Foundations Benchmark v5.0.0 |
|
| PCI-DSS v4.0.1 |
|
| HIPAA Security Rule |
|
| SOC 2 — Trust Services Criteria |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs
More IAM checks
- HighDeprecated or flawed AWS managed policy in use
- HighIAM role allows assumption from anywhere
- HighIAM role with admin privileges can be assumed by unexpected principals
- HighIAM role with s3 listing and get privileges can be assumed by unexpected principals
- HighIAM user access key has not been rotated in over 180 days
- HighIncorrect policy used to attempt to enforce MFA
- HighInline policy allows privilege escalation to admin
- HighPrincipal has an attached policy granting administrative access