Check ID:
Provider: AWS
Service:
Severity: HIGH
Categories:
Resource type:
iam_administrator_access_with_mfaProvider: AWS
Service:
iamSeverity: HIGH
Categories:
identity-accessResource type:
AwsIamGroupWhat this check verifies
IAM groups with theAdministratorAccess managed policy are assessed to ensure all member users have active MFA.
The finding highlights any administrator group that includes a user without MFA enrollment or activation.
Risk
Admin users without MFA are vulnerable to single-factor compromise. Stolen or guessed credentials can yield full control, enabling privilege escalation, policy changes, data exfiltration, and destructive operations, impacting confidentiality, integrity, and availability.Recommendation
Enforce MFA for all administrator identities.- Add conditions (e.g.,
aws:MultiFactorAuthPresent) to privileged permissions - Prefer hardware/FIDO2 devices
- Apply least privilege and favor roles/SSO over users
- Continuously monitor MFA status and remove unused admin access
Remediation
- CLI
- Native IaC
- Dashboard steps
References
- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html
- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html
- https://repost.aws/knowledge-center/mfa-iam-user-aws-cli
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = iam_administrator_access_with_mfa. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks