Back to Checks
huaweicloud

IAM users have MFA enabled

iam_user_mfa_enabled
Service: iamSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:NotDefined

Huawei Cloud IAM users should have MFA enabled. MFA adds an extra layer of protection on top of a username and password. With MFA enabled, when a user signs in to the Huawei Cloud console, they are prompted for their username and password as well as for an authentication code from their MFA device.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Without MFA, a compromised user password enables unauthorized access to cloud resources. An attacker could modify, delete, or create resources depending on the user's permissions, harming confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks iam_user_mfa_enabled

Recommendation

Enable MFA for all IAM users and enforce MFA at the account level.

Remediation

CLI

hcloud IAM UpdateLoginProtect --user_id=<user_id> --login_protect.enabled=true --login_protect.verification_method="vmfa"

Other

1Log on to the **Huawei Cloud console** as an administrator.
2Choose **IAM & Security**.
3Click **Users**.
4Select the target user.
5Click the **Security Settings** tab.
6In the **Virtual MFA Device** section, click **Enable**.
7Scan the QR code with a virtual MFA application (e.g., `Google Authenticator`).
8Enter two consecutive verification codes to bind the **MFA device**.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.iam.iam_client import iam_client


class iam_user_mfa_enabled(Check):
    """Check if Huawei Cloud IAM users have MFA enabled."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for user in iam_client.users:
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=user)
            report.region = iam_client.region
            report.resource_id = user.id
            report.resource_arn = (
                f"HUAWEICLOUD::IAM::{iam_client.audited_account}:user/{user.id}"
            )

            user_mfa_devices = [
                device for device in iam_client.mfa_devices if device.user_id == user.id
            ]

            if user_mfa_devices:
                report.status = "PASS"
                report.status_extended = f"IAM user {user.name} has MFA enabled."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"IAM user {user.name} does not have MFA enabled."
                )

            findings.append(report)

        return findings

References