VIEW RULE IN DATADOG

Description

An IAM user with administrative permissions has console access enabled without MFA in an AWS account with a weak password policy. The weak password policy combined with the absence of MFA means an attacker who compromises the user’s password can authenticate directly to the console with full administrative access. This allows unrestricted control over all AWS resources, including the ability to create or delete resources, modify security configurations, and access sensitive data.

Remediation

1. Enable MFA for the IAM user by following the AWS MFA documentation.
2. Update the account password policy in the IAM password policy settings to meet the criteria this detection evaluates, which follow NIST SP 800-63B Revision 4:
   • Set a minimum length of at least 15 characters.
   • Don’t require character composition (uppercase, lowercase, numbers, or symbols).
   • Don’t require password expiration.
3. Apply the principle of least privilege by removing unnecessary administrative permissions and use permission boundaries to limit user capabilities.