Back to Checks
aws

AWS Directory Service directory has RADIUS-based MFA enabled

directoryservice_supported_mfa_radius_enabled
Service: directoryserviceSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

AWS Directory Service directories are evaluated for RADIUS-backed multi-factor authentication, confirming that MFA is configured and the RADIUS integration is active.

Prowler logoProwlerprowler-provider-aws

Risk

Without RADIUS MFA, directory-based sign-ins to AWS-integrated services rely on a single factor, enabling credential stuffing and phishing to succeed. Compromised passwords can grant unauthorized access, drive data exfiltration, and enable privilege escalation, undermining confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks directoryservice_supported_mfa_radius_enabled

Recommendation

Enable and enforce RADIUS-based MFA for all Directory Service authentications. Apply least privilege, harden and monitor the RADIUS infrastructure, rotate shared secrets, and restrict network access (e.g., UDP/1812). Use defense in depth with segmentation and session controls to limit lateral movement and reduce blast radius.

Remediation

CLI

aws ds enable-radius --directory-id <example_resource_id> --radius-settings '{"RadiusServers":["<RADIUS_IP_OR_DNS>"],"SharedSecret":"<SHARED_SECRET>"}'

Terraform

resource "aws_directory_service_radius_settings" "<example_resource_name>" {
  directory_id  = "<example_resource_id>"            # Directory to enable RADIUS MFA on
  radius_servers = ["<RADIUS_IP_OR_DNS>"]             # Critical: RADIUS server endpoint(s)
  shared_secret  = "<SHARED_SECRET>"                   # Critical: Shared secret for RADIUS
}

Other

1Sign in to the AWS Console and open Directory Service
2Select your directory and open it
3Go to the Networking & security tab
4In Multi-factor authentication, click Actions > Enable
5Enter RADIUS server IP(s) and the Shared secret, then click Enable
6Wait until the RADIUS status shows Completed

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.directoryservice.directoryservice_client import (
    directoryservice_client,
)
from prowler.providers.aws.services.directoryservice.directoryservice_service import (
    RadiusStatus,
)


class directoryservice_supported_mfa_radius_enabled(Check):
    def execute(self):
        findings = []
        for directory in directoryservice_client.directories.values():
            if directory.radius_settings:
                report = Check_Report_AWS(metadata=self.metadata(), resource=directory)
                if directory.radius_settings.status == RadiusStatus.Completed:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Directory {directory.id} have Radius MFA enabled."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Directory {directory.id} does not have Radius MFA enabled."
                    )

                findings.append(report)

        return findings

References