Description

Detects AWS IAM users who have console access enabled but do not have Multi-Factor Authentication (MFA) configured. This represents a security risk since these users can access the AWS Management Console using only a password, making their accounts more vulnerable to unauthorized access through credential theft or brute force attacks.

Detection Strategy

• Identifies all IAM users in the AWS account

• Checks if each user has an active console login profile (can access AWS Management Console)

• Verifies if the user has any MFA devices configured

• Reports a vulnerability if a user has console access but zero MFA devices configured