openstreetmap
Ensure all AWS root accounts have MFA enabled
AWS requires root accounts to have MFA from May 16, 2024.
Ensure that all our accounts have MFA enabled on the root account and that the MFA secret is saved in our secrets store.
https://aws.amazon.com/blogs/security/security-by-design-aws-to-enhance-mfa-requirements-in-2024/
Documentation on how to enable: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable-overview.html
All servers face cold side correctly.
Our switches currently face rear of rack and have incorrect airflow (AFO, instead of AFI). Switching to AFI is ~£200 per switch.
Only the organisation owner account (osm-main) has an active root account and it now has MFA enabled (See ops pgp store for access). The sub-accounts now also have root credentials removed, password recover disabled and these sub-accounts require privileged operations to be performed via the organisation owner. The master account can also be used to re-allow password recovery of the root on the sub-accounts via IAM root management.
Some detailed on a centralised root which I have setup: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-enable-root-access.html