AWS securityhub documentation change
Summary
Enhanced MFA control documentation with explicit hardware MFA requirements and evaluation criteria
Security assessment
Strengthens guidance about hardware MFA requirements for root users but doesn't address a specific vulnerability
Diff
diff --git a/securityhub/latest/userguide/iam-controls.md b/securityhub/latest/userguide/iam-controls.md index 38a4fd7fe..3e2b3e8cd 100644 --- a/securityhub/latest/userguide/iam-controls.md +++ b/securityhub/latest/userguide/iam-controls.md @@ -9,3 +9 @@ -These AWS Security Hub controls evaluate the AWS Identity and Access Management (IAM) service and resources. - -These controls may not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). +These AWS Security Hub controls evaluate the AWS Identity and Access Management (IAM) service and resources. The controls might not be available in all AWS Regions. For more information, see [Availability of controls by Region](./securityhub-regions.html#securityhub-regions-control-support). @@ -199 +197,7 @@ We are offering a free MFA security key to eligible customers. [See if you quali -This control checks whether your AWS account is enabled to use a hardware multi-factor authentication (MFA) device to sign in with root user credentials. The control fails if MFA isn't enabled or if any virtual MFA devices are permitted for signing in with root user credentials. +This control checks whether your AWS account is enabled to use a hardware multi-factor authentication (MFA) device to sign in with root user credentials. The control fails if hardware MFA isn't enabled or virtual MFA devices are permitted for signing in with root user credentials. + +Virtual MFA might not provide the same level of security as hardware MFA devices. We recommend that you use a virtual MFA device only while you wait for hardware purchase approval or for your hardware to arrive. To learn more, see [ Assign a virtual MFA device (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html) in the _IAM User Guide_. + +###### Note + +Security Hub evaluates this control based on the presence of root user credentials (login profile) in an AWS account. The control generates `PASSED` findings in the following cases: @@ -201 +205 @@ This control checks whether your AWS account is enabled to use a hardware multi- -Virtual MFA might not provide the same level of security as hardware MFA devices. We recommend that you use only a virtual MFA device while you wait for hardware purchase approval or for your hardware to arrive. To learn more, see[ Enabling a virtual multi-factor authentication (MFA) device (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html) in the _IAM User Guide_. + * Root user credentials are present in the account and hardware MFA is enabled for the root user. @@ -203 +207,6 @@ Virtual MFA might not provide the same level of security as hardware MFA devices -Both time-based one-time password (TOTP) and Universal 2nd Factor (U2F) tokens are viable as hardware MFA options. + * Root user credentials aren’t present in the account. + + + + +The control generates a `FAILED` finding if root user credentials are present in the account and hardware MFA is not enabled for the root user. @@ -207 +216 @@ Both time-based one-time password (TOTP) and Universal 2nd Factor (U2F) tokens a -To add a hardware MFA device for the root user, see [Enable a hardware MFA device for the AWS account root user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_physical.html#enable-hw-mfa-for-root) in the _IAM User Guide_. +For information about enabling hardware MFA for the root user, see [Multi-factor authentication for an AWS account root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-mfa-for-root.html) in the _IAM User Guide_. @@ -209 +218 @@ To add a hardware MFA device for the root user, see [Enable a hardware MFA devic -We are offering a free MFA security key to eligible customers. [See if you qualify, and order your free key](https://console.aws.amazon.com/securityhub/home/?region=us-east-1#/free-mfa-security-key/). +We are offering a free MFA security key to eligible customers. To determine whether you're eligible, see the [MFA Security Key Program FAQs](https://console.aws.amazon.com/securityhub/home/?region=us-east-1#/free-mfa-security-key/).