Check ID: iam_user_hardware_mfa_enabled
Provider: AWS
Service: iam
Severity: HIGH
Categories: identity-access
Resource type: AwsIamUser

​
What this check verifies

IAM users are evaluated for hardware MFA enrollment, identifying physical tokens or security keys and distinguishing them from virtual or SMS MFA, as well as users without any MFA.

​
Risk

Without hardware MFA, authentication is weaker:
  • SIM-swap can bypass SMS
  • Phishing can steal TOTP from virtual apps
  • No MFA allows password-only takeover This enables unauthorized console/API access, causing data exfiltration (C), privilege abuse (I), and service disruption (A).

​
Recommendation

Require hardware-backed MFA for all IAM users. Prefer FIDO2 security keys for phishing resistance over TOTP or SMS. Disallow SMS/virtual MFA for privileged roles. Enforce MFA for all access paths, apply least privilege, and provision multiple MFA devices per user for continuity.

​
Remediation

Dashboard steps
  1. Sign in to the AWS Console and open IAM
  2. Go to Users > select <user> > Security credentials
  3. Under Multi-factor authentication (MFA), if a Virtual MFA device or SMS MFA is listed, choose Deactivate/Remove and confirm
  4. Click Assign MFA device
  5. Select Hardware TOTP token or Security key (FIDO2) and choose Next
  6. For Hardware TOTP: enter the device serial, then enter MFA code 1 and MFA code 2 from the token; for Security key: insert/tap the key and follow the prompts
  7. Choose Add/Save to complete

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_user_hardware_mfa_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks