Help Center/ Config/ User Guide/ Resource Compliance/ Built-In Policies/ Identity and Access Management/ Multi-Factor Authentication Check
Updated on 2024-10-15 GMT+08:00
View PDF
Share

Multi-Factor Authentication Check

Rule Details

Table 1 Rule details

Parameter

Description

Rule Name

iam-user-mfa-enabled

Identifier

iam-user-mfa-enabled

Description

If multi-factor authentication is not enabled for an IAM user, this user is noncompliant.

Tag

iam

Trigger Type

Configuration change

Filter Type

iam.users

Configure Rule Parameters

None

Applicable Scenario

Multi-factor authentication (MFA) adds an additional layer of security protection on top of the identity credentials for an account. It is recommended that you enable MFA authentication for your account and privileged users created using your account. After MFA authentication is enabled, you need to enter verification codes after your username and password are authenticated. MFA devices, together with your username and password, ensure the security of your account and resources.

Solution

To enable the MFA, you need to install an MFA application (such as the Google Authenticator or Microsoft Authenticator) on your mobile device. For more details, see Binding a Virtual MFA Device.

Rule Logic

  • If an IAM user is disabled, this user is compliant.
  • If an IAM user is enabled and has MFA enabled, this user is compliant.
  • If an IAM user is enabled, but does not have MFA enabled, this user is noncompliant.