Root MFA Enabled

01 Sign in to the AWS Management Console using the root account credentials.

02 Click on the AWS account name/number available in the upper-right corner of the Management Console and select My Security Credentials from the dropdown menu.

03 On Your Security Credentials page, click on the Multi-factor authentication (MFA) tab to expand the panel with the MFA configuration settings available for the root account.

04 On the Multi-factor authentication (MFA) panel, check for any MFA devices enabled for the AWS root account. If there are no MFA devices configured and the Amazon IAM console shows the Activate MFA button, your AWS root account is not MFA-protected and the authentication process for the root user is not following Amazon IAM security best practices.

05 Repeat steps no. 1 – 4 for each AWS root account that you want to examine.

01 Run get-credential-report command (OSX/Linux/UNIX) to obtain the IAM credential report for your AWS cloud account. A credential report is a CSV document that lists all the AWS users (root and IAM users) created within your AWS cloud account and the current status of their access credentials:

aws iam get-credential-report

02 The command output should return the requested document in a TEXT/CSV format, encoded with the Base64 encoding scheme, as shown in the example below:

{
  "Content": "abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd",
  "ReportFormat": "text/csv",
  "GeneratedTime": "2021-04-16T15:00:00+00:00"
}

03 Decode the IAM credential report content from the command line (OSX/Linux/UNIX) using the Base64 string returned at the previous step as the input data. In the following example, the report is decoded and saved to a file named cc-iam-credentials-report.csv:

echo -n abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd | base64 –d >> cc-iam-credentials-report.csv

04 Open the cc-iam-credentials-report.csv file in a text editor and check the value available in the mfa_active column for the <root_account> user. If the value set for the mfa_active configuration attribute is FALSE, your AWS root account is not MFA-protected and the root authentication process is not following Amazon IAM security best practices.

05 Repeat steps no. 1 – 4 for each AWS root account that you want to examine.