Query: iam_credential_entities_console_access_with_no_mfa_count

select
  count(*) as value,
  'Console Access and No MFA' as label,
  case when count(*) = 0 then 'ok' else 'alert' end as type
from
  aws_iam_credential_report
where
  password_enabled
  and not mfa_active;