1. Sign in to the AWS Management Console as a root user or an IAM user.
2. In the navigation pane, choose “Users”. If the AWS account root user is signed in, the navigation pane is not available. In that case, choose “Dashboard” and then choose “Manage Security Credentials”.
3. In the “User” section, find the user that you want to check for MFA. In the “Security Credentials” column, look for a checkmark in the MFA column. If there’s a checkmark, the user has MFA enabled. If there’s no checkmark, the user doesn’t have MFA enabled.
4. To check for External ID, navigate to the IAM role that you want to check. Under the “Trust relationships” tab, click on “Edit trust relationship”. In the policy document, look for “sts:ExternalId”. If it’s present, then the External ID is set. If it’s not present, then the External ID is not set.

1. First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Once you have AWS CLI installed and configured, you can proceed to the next steps.
2. To check if the root account has MFA enabled, you can use the following command:
   aws iam get-account-summary
   
   This command will return a JSON object that contains information about the account. Look for the “AccountMFAEnabled” field in the output. If the value of this field is 1, then MFA is enabled for the root account. If the value is 0, then MFA is not enabled.
3. To check if the root account has an external ID set, you can use the following command:
   aws iam list-roles
   
   This command will return a list of all roles in the account. For each role, check the “AssumeRolePolicyDocument” field in the output. If the policy document contains a “sts:ExternalId” condition, then the role has an external ID set.
4. If you want to automate these checks, you can write a Python script that uses the Boto3 library to interact with the AWS API. The script would use the get_account_summary and list_roles methods of the IAM client to perform the same checks as the CLI commands above.

1. AWS SDK for Python (Boto3) can be used to interact with AWS services. To check if the root account has MFA enabled, you can use the IAM client in Boto3. First, you need to import Boto3 and create an IAM client:

import boto3
iam = boto3.client('iam')

2. Then, you can use the get_account_summary method to get information about the account. This method returns a dictionary with various account attributes. The AccountMFAEnabled attribute indicates whether MFA is enabled for the root account:

response = iam.get_account_summary()
if response['SummaryMap']['AccountMFAEnabled'] == 1:
    print("MFA is enabled for the root account.")
else:
    print("MFA is not enabled for the root account.")

3. To check if the root account has an external ID set, you can use the list_roles method to get a list of all IAM roles in the account. Then, you can iterate over the roles and check the AssumeRolePolicyDocument attribute for each role. If the sts:ExternalId condition is present in the policy document, it means that the role requires an external ID for access:

roles = iam.list_roles()['Roles']
for role in roles:
    policy_document = role['AssumeRolePolicyDocument']
    if 'sts:ExternalId' in str(policy_document):
        print(f"Role {role['RoleName']} requires an external ID.")

4. Note that the above script only checks if any role in the account requires an external ID. It does not check if the root account specifically has an external ID set. This is because the root account does not have an associated IAM role and therefore does not have an AssumeRolePolicyDocument. The external ID is typically used in a cross-account role scenario, where one AWS account assumes a role in another account. In this case, the external ID is set in the trusting account (the account that owns the role), not in the trusted account (the account that assumes the role).

1. Enable Multi-Factor Authentication (MFA) for the Root Account:
   • Log in to the AWS Management Console using the root account credentials.
   • Navigate to the IAM service.
   • In the navigation pane, click on “Users”.
   • Click on the root account username.
   • In the “Security credentials” tab, locate the “Assigned MFA device” section and click on “Manage”.
   • Follow the prompts to set up MFA for the root account. You can choose to use a virtual MFA device or a hardware MFA device.
   • Once MFA is enabled, make sure to complete the MFA setup process.
2. Set an External ID for the Root Account:
   • While still in the IAM Management Console, click on the root account username.
   • In the “Permissions” tab, click on the “Add inline policy” button.
   • Select the JSON tab to provide a custom policy.
   • Enter a policy document similar to the following, replacing YOUR_EXTERNAL_ID with your desired external ID:
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "*",
               "Resource": "*",
               "Condition": {
                   "StringEquals": {
                       "sts:ExternalId": "YOUR_EXTERNAL_ID"
                   }
               }
           }
       ]
   }
   
   • Click on Review policy, provide a name for the policy, and click on “Create policy”.
3. Test the External ID:
   • To test the External ID, you can try to assume a role that requires the External ID. If the External ID is set correctly, the assumption of the role should succeed.

​

1. Enable MFA for Root Account:
   • Run the following AWS CLI command to enable MFA for the root account:
     aws iam enable-mfa-device --user-name <root_account_username> --serial-number arn:aws:iam::<account_id>:mfa/root-account-mfa
     
     Replace <root_account_username> with the root account’s username and <account_id> with your AWS account ID.
2. Set External ID for Root Account:
   • Generate a random external ID using a tool like openssl:
     openssl rand -hex 32
     
   • Copy the generated External ID.
3. Attach the Policy to the Root Account:
   • Run the following AWS CLI command to attach the IAMFullAccess policy to the root account with the External ID:
     aws iam attach-user-policy --user-name <root_account_username> --policy-arn arn:aws:iam::aws:policy/IAMFullAccess --policy-inputs '{"ExternalId":"<generated_external_id>"}'
     
     Replace <root_account_username> with the root account’s username and <generated_external_id> with the External ID you generated in step 2.
4. Verify Configuration:
   • To verify that MFA and External ID are set for the root account, run the following AWS CLI commands:
     • Check MFA status:
       aws iam list-mfa-devices --user-name <root_account_username>
       
     • Check attached policies with External ID:
       aws iam list-attached-user-policies --user-name <root_account_username>
       

1. Install Boto3: If you haven’t installed Boto3 yet, you can install it using pip:
   pip install boto3
   
2. Create a Python script: Create a Python script (e.g., remediate_root_account_mfa.py) and import the necessary libraries:
   import boto3
   
3. Enable MFA for the root account: You can use the following code snippet to enable MFA for the root account:
   iam_client = boto3.client('iam')
   iam_client.enable_mfa_device(UserName='root', SerialNumber='arn:aws:iam::aws:policy/IAMUser')
   
4. Set External ID for the root account: You can use the following code snippet to set an External ID for the root account:
   account_id = boto3.client('sts').get_caller_identity().get('Account')
   external_id = 'your_external_id_here'
   
   iam_client.create_account_alias(AccountAlias=external_id)
   
5. Run the Python script: Execute the Python script using the command:
   python remediate_root_account_mfa.py