IAM users are evaluated for hardware MFA enrollment, identifying physical tokens or security keys and distinguishing them from virtual or SMS MFA, as well as users without any MFA.
Risk
Without hardware MFA, authentication is weaker:
- SIM-swap can bypass SMS
- Phishing can steal TOTP from virtual apps
- No MFA allows password-only takeover This enables unauthorized console/API access, causing data exfiltration (C), privilege abuse (I), and service disruption (A).
Run this check with Prowler CLI
prowler aws --checks iam_user_hardware_mfa_enabled
Recommendation
Require hardware-backed MFA for all IAM users. Prefer FIDO2 security keys for phishing resistance over TOTP or SMS. Disallow SMS/virtual MFA for privileged roles. Enforce MFA for all access paths, apply least privilege, and provision multiple MFA devices per user for continuity.
Remediation
Other
- Sign in to the AWS Console and open IAM
- Go to Users > select <user> > Security credentials
- Under Multi-factor authentication (MFA), if a Virtual MFA device or SMS MFA is listed, choose Deactivate/Remove and confirm
- Click Assign MFA device
- Select Hardware TOTP token or Security key (FIDO2) and choose Next
- For Hardware TOTP: enter the device serial, then enter MFA code 1 and MFA code 2 from the token; for Security key: insert/tap the key and follow the prompts
- Choose Add/Save to complete
Source Code
Resource Type
AwsIamUser