Back to Checks
aws

IAM group members granted AdministratorAccess have MFA enabled

iam_administrator_access_with_mfa
Service: iamSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamGroup

IAM groups with the AdministratorAccess managed policy are assessed to ensure all member users have active MFA.

The finding highlights any administrator group that includes a user without MFA enrollment or activation.

Prowler logoProwlerprowler-provider-aws

Risk

Admin users without MFA are vulnerable to single-factor compromise. Stolen or guessed credentials can yield full control, enabling privilege escalation, policy changes, data exfiltration, and destructive operations, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_administrator_access_with_mfa

Recommendation

Enforce MFA for all administrator identities.

  • Add conditions (e.g., aws:MultiFactorAuthPresent) to privileged permissions
  • Prefer hardware/FIDO2 devices
  • Apply least privilege and favor roles/SSO over users
  • Continuously monitor MFA status and remove unused admin access

Remediation

CLI

aws iam detach-group-policy --group-name <IAM_GROUP_NAME> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

NativeIaC

# CloudFormation: ensure the IAM group does not have AdministratorAccess attached
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Group
    Properties:
      GroupName: <example_resource_name>
      ManagedPolicyArns: []  # Critical: remove AdministratorAccess from this group to avoid admin rights without MFA

Other

1In the AWS Console, go to IAM > User groups and open the group that has the AdministratorAccess policy.
2Note the users listed in the group. For each user, open IAM > Users > <user>.
3On the Security credentials tab, under Multi-factor authentication (MFA), select Assign MFA device.
4Choose Authenticator app (or a security key), follow the prompts, enter the two MFA codes, and click Add MFA.
5Repeat for all users in the group. Verify in IAM > Credential report that mfa_active is true for each user.

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_administrator_access_with_mfa(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        response = iam_client.groups

        for group in response:
            report = Check_Report_AWS(metadata=self.metadata(), resource=group)
            report.region = iam_client.region
            report.status = "PASS"
            report.status_extended = f"Group {group.name} has no policies."

            if group.attached_policies:
                report.status_extended = (
                    f"Group {group.name} provides non-administrative access."
                )
                for group_policy in group.attached_policies:
                    if (
                        group_policy["PolicyArn"]
                        == f"arn:{iam_client.audited_partition}:iam::aws:policy/AdministratorAccess"
                    ):
                        # users in group are Administrators
                        if group.users:
                            for group_user in group.users:
                                for user in iam_client.credential_report:
                                    if (
                                        user["user"] == group_user.name
                                        and user["mfa_active"] == "false"
                                    ):
                                        report.status = "FAIL"
                                        report.status_extended = f"Group {group.name} provides administrator access to User {group_user.name} with MFA disabled."
                        else:
                            report.status_extended = f"Group {group.name} provides administrative access but does not have users."

            findings.append(report)

        return findings

References