MFA Device Deactivated

MFA device deactivated for IAM users. When DeactivateMFADevice event is triggered, the system decommissions the specified MFA device and removes it from association with the IAM user name for which it was originally enabled, removing the extra layer of protection, set for the IAM user to achieve stronger authentication. An IAM user is an identity created for your Amazon Web Services account that has specific custom permissions (for example, permissions to create and configure IAM roles). You can use an IAM user name and password to sign in to your AWS Management Console to access all or your AWS resources or just a certain service or resource (by implementing the principle of least privilege). As a security best practice, it is always recommended to supplement your usual IAM user names and passwords with a one-time passcode during authentication. This method is known as Multi-Factor Authentication and allows you to enable extra security for your Amazon IAM users. Multi-Factor Authentication (MFA) is a simple and efficient method of verifying your IAM user identity by requiring an authentication code generated by a virtual or hardware device, used in addition to your usual access credentials (i.e. username and password). The MFA device signature adds an extra layer of protection on top of your existing user credentials making your AWS account virtually impossible to breach without the unique code generated by the device. However, in large organizations or multi-tier AWS environments with tens or hundreds of users, to secure the access to Amazon cloud resources, it is absolutely necessary to monitor any request made to decommission the MFA device associated with the IAM user. For example, a privileged IAM user within your organization account is having trouble signing in with a Multi-Factor Authentication device so the user deactivates the device to be able to sign in without using MFA. The user might do this as a temporary solution while the MFA device is replaced. To ensure that a new MFA device is enabled as soon as possible and associated with the involved IAM user, you need to be notified first about the event. Cloud Conformity RTMA will detect the DeactivateMFADevice event and send notifications to the recipients defined within your Cloud Conformity account settings. The communication channels for sending these notifications can be easily configured within Cloud Conformity account. The list of supported communication channels that you can use to receive notification event alerts are Email, SMS, Slack, PagerDuty, ServiceNow and Zendesk. Cloud Conformity strongly recommends using this RTMA feature to ensure that Multi-Factor Authentication stays enabled 24/7 for privileged IAM users (users with access to certain AWS resources or that are exposed to sensitive data) in order to maintain a secure access to your Amazon Web Services account and adhere to security best practices.

This rule can help you with the following compliance standards:

• APRA
• MAS
• NIST4

For further details on compliance standards supported by Conformity, see here.

This rule can help you work with the AWS Well-Architected Framework.

This rule resolution is part of the Conformity Real-Time Threat Monitoring.