AWS Console Root Login Without MFA
Dash が新機能を発表！インシデントマネジメント、Continuous Profiler など多数の機能が追加されました！ Dash イベントで発表された新機能！
<  Back to rules search

AWS Console Root Login Without MFA

cloudtrail

Classification:

compliance

Framework:

cis-aws

Control:

cis-3.2

Set up the cloudtrail integration.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Overview

Goal

Detect when a root user logs into the AWS console without multi-factor authentication.

Strategy

Monitor CloudTrail and detect when any @evt.name has a value of Console Login, @userIdentity.type has a value of Root, and @additionalEventData.MFAUsed has a value of no.

Note: This rule ignores logins using SAML because 2FA is implemented on the IdP and not through AWS.

Triage & Response

  1. Reach out to the user to determine if the login was legitimate.
  2. If the login was legitimate, request that the user enables 2FA on the root account.
  3. If the login wasn’t legitimate, rotate the credentials.
  4. Review all root user accounts to ensure MFA is enabled.

Note: There is a separate rule to detect Login without MFA for non-root users.

このページ