Back to Checks
huaweicloud

Root account enforces MFA through operation protection

iam_root_hardware_mfa_enabled
Service: iamSeverity: critical
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

The Huawei Cloud account (root/domain owner) should enforce MFA. Because the domain owner is not a listable IAM user, root MFA is assessed through the account's operation protection policy, which requires MFA verification (virtual MFA, SMS, or email) before critical operations such as deleting resources or managing credentials can be performed.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Without operation protection, a compromised root password enables full account takeover with no additional verification. An attacker could delete resources, change policies, and disable logging, harming confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks iam_root_hardware_mfa_enabled

Recommendation

Enable operation protection for the account and avoid using root credentials for daily operations.

Remediation

CLI

hcloud IAM UpdateDomainProtectPolicy --domain_id=<domain_id> --protect_policy.operation_protection=true

Other

1Log on to the **Huawei Cloud console** as the account administrator.
2Go to **Security Settings** > **Critical Operations**.
3In the **Operation Protection** section, click **Enable**.
4Choose the verification method (`virtual MFA`, `SMS`, or `email`) and save.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.iam.iam_client import iam_client


class iam_root_hardware_mfa_enabled(Check):
    """Check if the Huawei Cloud account enforces MFA on the root account.

    The account/root (domain owner) is not a listable IAM user in Huawei
    Cloud, so root MFA is assessed through the account's operation protection
    policy, which forces MFA verification for sensitive operations.
    """

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        protection = iam_client.operation_protection

        report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=protection)
        report.region = iam_client.region
        report.resource_id = f"{iam_client.audited_account}-operation-protection"
        report.resource_name = report.resource_id
        report.resource_arn = (
            f"HUAWEICLOUD::IAM::{iam_client.audited_account}:operation-protection"
        )

        if protection.enabled:
            report.status = "PASS"
            report.status_extended = (
                "Root account is protected: account operation protection "
                "(MFA verification for critical operations) is enabled."
            )
        else:
            report.status = "FAIL"
            report.status_extended = (
                "Root account is not protected: account operation protection "
                "(MFA verification for critical operations) is not enabled."
            )

        findings.append(report)

        return findings

References