AWS Directory Service directory has RADIUS-based MFA enabled

Check ID: directoryservice_supported_mfa_radius_enabled
Provider: AWS
Service: directoryservice
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

AWS Directory Service directories are evaluated for RADIUS-backed multi-factor authentication, confirming that MFA is configured and the RADIUS integration is active.

Risk

Without RADIUS MFA, directory-based sign-ins to AWS-integrated services rely on a single factor, enabling credential stuffing and phishing to succeed. Compromised passwords can grant unauthorized access, drive data exfiltration, and enable privilege escalation, undermining confidentiality and integrity.

Recommendation

Enable and enforce RADIUS-based MFA for all Directory Service authentications. Apply least privilege, harden and monitor the RADIUS infrastructure, rotate shared secrets, and restrict network access (e.g., UDP/1812). Use defense in depth with segmentation and session controls to limit lateral movement and reduce blast radius.

Remediation

CLI
Terraform
Dashboard steps

aws ds enable-radius --directory-id <example_resource_id> --radius-settings '{"RadiusServers":["<RADIUS_IP_OR_DNS>"],"SharedSecret":"<SHARED_SECRET>"}'

resource "aws_directory_service_radius_settings" "<example_resource_name>" {
  directory_id  = "<example_resource_id>"            # Directory to enable RADIUS MFA on
  radius_servers = ["<RADIUS_IP_OR_DNS>"]             # Critical: RADIUS server endpoint(s)
  shared_secret  = "<SHARED_SECRET>"                   # Critical: Shared secret for RADIUS
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = directoryservice_supported_mfa_radius_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Directory Service directory RADIUS server uses MS-CHAPv2 Region with EBS snapshots has a snapshot lifecycle policy

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires