Description
Without an account-wide MFA requirement, individual user settings may permit password-only console sign-in. An additional factor strengthens protection against password theft.
Potential impact
Users without MFA face a greater risk of account access if their passwords are exposed.
Remediation
Prepare MFA enrollment and recovery procedures, then require MFA for console sign-in. The existing enforce_mfa_for_login = true field sets this account-wide requirement.
Examples
The examples add the requirement using the existing compatible field. Current configurations can set mfa_operation_for_login to mandatory.
Before
hcl
resource "alicloud_ram_security_preference" "example" {
enable_save_mfa_ticket = false
allow_user_to_change_password = true
}
After
hcl
resource "alicloud_ram_security_preference" "example" {
enable_save_mfa_ticket = false
allow_user_to_change_password = true
enforce_mfa_for_login = true
}