Skip to main content
Checks that all AWS IAM users have MFA enabled.

​
About

When you connect Amazon Web Services (AWS) to DSALTA, the platform syncs your users, roles, and access settings using read-only API access. DSALTA evaluates this control on every sync. If the requirement is not met, DSALTA activates this check.

​
Why This Matters

A password alone is a single point of failure. If it is phished, guessed, or reused from a breached site, an attacker gains full access. Multi-factor authentication adds a second verification step that blocks the vast majority of account-takeover attempts and is a baseline requirement across SOC 2, ISO 27001, and most security frameworks.

​
How to Fix

Before you begin
  • Ensure you have IAM admin permissions in the AWS account.
  • Identify which IAM users do not yet have an MFA device assigned.
Assign an MFA device to each user
  1. Sign in to the AWS Management Console and navigate to IAM → Users.
  2. Select a user without MFA, then open the Security credentials tab.
  3. Under Multi-factor authentication (MFA), click Assign MFA device.
  4. Choose the device type — Authenticator app, Security key, or Hardware TOTP token.
  5. Follow the prompts to register and verify the device.
  6. Repeat for every IAM user that signs in to the console.
Once MFA is enabled for all users, DSALTA retrieves the change on the next sync and sets the check status to Passing.

​
Frequently Asked Questions

This check runs automatically every 24 hours while the Amazon Web Services (AWS) integration is connected. You can also trigger a manual sync from Integrations in the sidebar.
A failing check appears in your Data Library → Tests dashboard. Work through the steps above; once the underlying configuration is fixed, the status updates automatically on the next sync.
Yes. If it does not apply to your environment, mark it as Not Applicable with a justification. The exclusion is documented for auditors.
No. DSALTA uses read-only API access and never modifies, creates, or deletes resources. All remediation is performed by your team directly in Amazon Web Services (AWS).