IAM user has MFA enabled for console access or no console password is set
iam_user_mfa_enabled_console_access
IAM users that have a console password are expected to have multi-factor authentication enabled. The evaluation identifies users who can sign in to the AWS Management Console but do not have an active MFA device associated.
Risk
Without MFA, a stolen or brute-forced password grants full interactive access. Attackers can: - Change policies or keys - Exfiltrate data - Create backdoor users - Disable logging. This enables account takeover, threatens confidentiality and integrity, and can disrupt availability.
prowler aws --checks iam_user_mfa_enabled_console_access
Recommendation
Enforce MFA for all console-capable IAM users; prefer phishing-resistant authenticators (FIDO2/security keys) and register backups. Remove console passwords for users that don't need them and favor federation/SSO. Apply least privilege and require MFA for sensitive actions to prevent unauthorized changes.
Remediation
aws iam delete-login-profile --user-name <IAM_USER_NAME>
- Sign in to the AWS Console and open IAM
- Go to Users and select the affected user
- Open the Security credentials tab
- Under Console sign-in, click Remove console password and confirm
- Verify that Console password shows Not enabled
Source Code
Resource Type
AwsIamUser