Panther critical experimental python

AWS Root Account MFA

Validates that Multi-Factor Authentication (MFA) is enabled for the AWS root account. The root account has complete unrestricted access to all AWS resources and is the highest-value target for attackers. Without MFA, accounts are vulnerable to phishing, credential stuffing, and password compromise attacks.

View Source

Detection Logic

from panther_base_helpers import deep_get


def policy(resource):
    # Explicit check for True as the value may be None, and we want to return a bool not a NoneType
    return deep_get(resource, "CredentialReport", "MfaActive") is True

Field Validations

Loading…

Comments (0)

Loading comments...