Back to Checks
aws

IAM user has MFA enabled for console access or no console password is set

iam_user_mfa_enabled_console_access
Service: iamSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamUser

IAM users that have a console password are expected to have multi-factor authentication enabled. The evaluation identifies users who can sign in to the AWS Management Console but do not have an active MFA device associated.

Prowler logoProwlerprowler-provider-aws

Risk

Without MFA, a stolen or brute-forced password grants full interactive access. Attackers can: - Change policies or keys - Exfiltrate data - Create backdoor users - Disable logging. This enables account takeover, threatens confidentiality and integrity, and can disrupt availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_user_mfa_enabled_console_access

Recommendation

Enforce MFA for all console-capable IAM users; prefer phishing-resistant authenticators (FIDO2/security keys) and register backups. Remove console passwords for users that don't need them and favor federation/SSO. Apply least privilege and require MFA for sensitive actions to prevent unauthorized changes.

Remediation

CLI

aws iam delete-login-profile --user-name <IAM_USER_NAME>

Terraform

# IAM user without console password
resource "aws_iam_user" "user" {
  name = "<example_resource_name>"
  # Critical: Do NOT create an aws_iam_user_login_profile resource.
  # Without a login profile, no console password is set, so the check passes.
}

NativeIaC

# CloudFormation: IAM user without a console password
Resources:
  IamUser:
    Type: AWS::IAM::User
    Properties:
      UserName: <example_resource_name>
      # Critical: Do NOT include the LoginProfile property.
      # Omitting LoginProfile ensures no console password is set, making the check pass.

Other

1Sign in to the AWS Console and open IAM
2Go to Users and select the affected user
3Open the Security credentials tab
4Under Console sign-in, click Remove console password and confirm
5Verify that Console password shows Not enabled

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_user_mfa_enabled_console_access(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        response = iam_client.credential_report
        for user in response:
            # all the users but root (which by default does not support console password)
            if user["user"] != "<root_account>":
                report = Check_Report_AWS(metadata=self.metadata(), resource=user)
                report.resource_id = user["user"]
                report.resource_arn = user["arn"]
                report.region = iam_client.region
                # Search user in iam_client.users to get tags
                for iam_user in iam_client.users:
                    if iam_user.arn == user["arn"]:
                        report.resource_tags = iam_user.tags
                        break
                # check if the user has password enabled
                if user["password_enabled"] == "true":
                    if user["mfa_active"] == "false":
                        report.status = "FAIL"
                        report.status_extended = f"User {user['user']} has Console Password enabled but MFA disabled."
                    else:
                        report.status = "PASS"
                        report.status_extended = f"User {user['user']} has Console Password enabled and MFA enabled."
                else:
                    report.status = "PASS"
                    report.status_extended = (
                        f"User {user['user']} does not have Console Password enabled."
                    )
                findings.append(report)

        return findings

References