Panther high experimental python

AWS Root Account Hardware MFA

This policy validates that a hardware MFA device is in use for access to the root account.

View Source

Detection Logic

from panther_base_helpers import deep_get


def policy(resource):
    if not deep_get(resource, "CredentialReport", "MfaActive"):
        # MFA is not enabled, this is reported by a different rule
        return True
    return resource["VirtualMFA"] is None

Field Validations

Loading…

Comments (0)

Loading comments...