Quick Wins Identity and Access Management 🤝 Shared

r8.1 Require MFA for all console and CDE access

Enable multi-factor authentication for all access, particularly to the CDE and administrative accounts, as a high-impact quick win against the use of compromised credentials.

Quick Wins

Foundational

Efficient

Optimized

Effort: Low Impact: High Applies to CDE: Yes

AWS services

AWS IAM

AWS IAM Identity Center

AWS Security Hub

Requirement 8

Identify Users and Authenticate Access to System Components

PCI sub-requirements covered

8.4 Multi-factor authentication (MFA) is implemented to secure access into the CDE
8.5 MFA systems are configured to prevent misuse

How to implement on AWS

Enforce MFA in IAM Identity Center and on each account's root user. Require MFA in IAM policies for sensitive actions (aws:MultiFactorAuthPresent condition). Configure MFA to be resistant to replay and to apply to all CDE access. Detect accounts without MFA using Security Hub/Config.

Practical implementation

How this control is implemented in each reference architecture:

Enforce MFA on the account root and on IAM Identity Center users, and require MFA for sensitive actions via IAM policy conditions; Security Hub/Config flag any account or user without MFA.

Single-account, 3-tier →

Enforce MFA centrally through IAM Identity Center for access to all accounts, back it with an SCP on the PCI OU, and monitor MFA posture org-wide from the security tooling account.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

Examine network/system configurations to verify MFA is required for all non-console administrative access into the CDE and for all non-console access into the CDE (8.4.1.a, 8.4.2.a).
Observe personnel/administrators logging into the CDE to verify MFA is required (8.4.1.b, 8.4.2.b).
Examine MFA configurations to verify the system is not susceptible to replay and grants access only after all factors succeed (8.5.1.a, 8.5.1.b, 8.5.1.d).

Evidence in AWS

MFA enabled in IAM Identity Center and on the root user (Config/Security Hub evidence).
IAM policies with the aws:MultiFactorAuthPresent condition for CDE access.
Resolved Security Hub findings on MFA (IAM.*).

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

8.4 — Administrative and all non-console access into the CDE cannot be obtained by the use of a single authentication factor.
8.5 — MFA systems are resistant to attack and strictly control any administrative overrides.

Learning resources

Using MFA in AWS (doc)

References

AWS Security Maturity Model: MFA everywhere
PCI DSS v4.0.1 Requirements 8.4, 8.5