Panther high experimental python

AWS IAM User MFA

This policy validates that all AWS IAM users with access to the AWS Console have Multi-Factor Authentication (MFA) enabled.

View Source

Detection Logic

from panther_base_helpers import deep_get


def policy(resource):
    # If password logins are disabled, we don't need to worry about MFA
    if not deep_get(resource, "CredentialReport", "PasswordEnabled"):
        return True

    # Explicit True check to avoid returning NoneType
    return deep_get(resource, "CredentialReport", "MfaActive") is True

Field Validations

Loading…

Comments (0)

Loading comments...