Control: IAM root user MFA should be enabled

powerpipe control run aws_compliance.control.iam_root_user_mfa_enabled

powerpipe login
powerpipe control run aws_compliance.control.iam_root_user_mfa_enabled --share

select
  'arn:' || partition || ':::' || account_id as resource,
  case
    when account_mfa_enabled then 'ok'
    else 'alarm'
  end status,
  case
    when account_mfa_enabled then 'MFA enabled for root account.'
    else 'MFA not enabled for root account.'
  end reason
  , account_id
from
  aws_iam_account_summary;