Rule: IAM Root User Hardware MFA Should be Enabled
This rule ensures that IAM Root User Hardware MFA is enabled for added security.
| Rule | IAM root user hardware MFA should be enabled |
| Framework | NIST 800-53 Revision 5 |
| Severity | ✔ Critical |
Rule Description: IAM root user hardware MFA for NIST 800-53 Revision 5
This rule requires that the IAM root user must have hardware MFA (Multi-Factor Authentication) enabled in order to comply with the NIST 800-53 Revision 5 security guidelines. Enabling hardware MFA adds an extra layer of security by requiring an additional physical token or device to access the root user account.
Troubleshooting:
- If the hardware MFA is not already enabled for the IAM root user, the system will flag it as non-compliant with this policy.
- Troubleshooting steps:
- 1.Verify if the IAM root user has hardware MFA enabled.
- 2.Ensure the correct hardware token or device is used for authentication.
- 3.Check if any MFA exceptions or overrides have been configured for the root user.
- 4.Ensure the MFA device is correctly synced and connected.
Necessary Code:
There is no specific code required for this policy. Instead, it involves the following steps to enforce hardware MFA for the IAM root user.
Steps for Remediation:
- 1.Access the AWS Management Console using the IAM root user credentials.
- 2.Go to the IAM service.
- 3.In the left navigation pane, click on "Users".
- 4.Search for the IAM root user and select it.
- 5.Click on the "Security credentials" tab.
- 6.Under "Multi-Factor Authentication (MFA)", click on "Manage MFA device".
- 7.Follow the on-screen instructions to set up the hardware MFA device for the IAM root user.
- 8.Once the MFA device setup is complete, the IAM root user will have hardware MFA enabled.
- 9.Validate the MFA setup by logging out and logging back in using the IAM root user credentials and the hardware MFA device.
- 10.Ensure that the hardware MFA device is kept secure and accessible only to authorized individuals.
Note: The specifics of the MFA setup may vary depending on the hardware MFA device being used (e.g., physical hardware token, virtual MFA device). Consult the documentation provided with the respective MFA device for detailed instructions on setup and usage.
By enforcing hardware MFA for the IAM root user, your AWS account will comply with the NIST 800-53 Revision 5 security guidelines, providing an additional layer of protection to your root user account.