Control: IAM users should have hardware MFA enabled

powerpipe control run aws_compliance.control.iam_user_hardware_mfa_enabled

powerpipe login
powerpipe control run aws_compliance.control.iam_user_hardware_mfa_enabled --share

select
  u.arn as resource,
  case
    when serial_number is null then 'alarm'
    when serial_number like any(array['%mfa%','%sms-mfa%']) then 'info'
    else 'ok'
  end as status,
  case
    when serial_number is null then u.name || ' MFA device not configured.'
    when serial_number like any(array['%mfa%','%sms-mfa%']) then u.name || ' MFA enabled, but the MFA associated is a virtual device.'
    else u.name || ' hardware MFA device enabled.'
  end as reason
  
  , u.region, u.account_id
from
  aws_iam_virtual_mfa_device as m
  right join aws_iam_user as u on m.user_id = u.user_id;