Query: iam_accounts_without_root_mfa

select
  count(*) filter (where not account_mfa_enabled) as value,
  'Accounts Without Root MFA' as label,
  case when count(*) filter (where not account_mfa_enabled) = 0 then 'ok' else 'alert' end as type
from
  aws_iam_account_summary;