Benchmark: 8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE
Description
Requiring more than one type of authentication factor reduces the probability that an attacker can gain access to a system by masquerading as a legitimate user, because the attacker would need to compromise multiple authentication factors. This is especially true in environments where traditionally the single authentication factor employed was something a user knows, such as a password or passphrase.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-aws-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select 8.4.3 MFA is implemented for all remote access originating from outside the entity's network that could access or impact the CDE.
Run this benchmark in your terminal:
powerpipe benchmark run aws_compliance.benchmark.pci_dss_v40_requirement_8_4_3Snapshot and share results via Turbot Pipes:
powerpipe benchmark run aws_compliance.benchmark.pci_dss_v40_requirement_8_4_3 --shareControls
- IAM root user hardware MFA should be enabled
- IAM root user MFA should be enabled
- IAM users with console access should have MFA enabled
- IAM user MFA should be enabled
- Ensure MFA Delete is enabled on S3 buckets