PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 8 / c8.1
Quick Wins Identity and Access ManagementSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c8.1 Require MFA for all console and CDE access

Enable multi-factor authentication for all access, particularly to the CDE and administrative accounts, as a high-impact quick win against the use of compromised credentials.

Quick Wins
Foundational
Efficient
Optimized
Effort: Low Impact: High Applies to CDE: Yes

Requirement 8

Identify Users and Authenticate Access to System Components

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

8.4 Multi-factor authentication (MFA) is implemented to secure access into the CDE
  • 8.4.1 MFA for all non-console admin access into the CDE Covered
  • 8.4.2 MFA for all non-console access into the CDE Covered
  • 8.4.3 MFA for all remote access originating from outside the network Covered
8.5 MFA systems are configured to prevent misuse
  • 8.5.1 MFA systems resist replay, cannot be bypassed, use strong factors Covered

How to implement on AWS

Enforce MFA in IAM Identity Center and on each account's root user. Require MFA in IAM policies for sensitive actions (aws:MultiFactorAuthPresent condition). Configure MFA to be resistant to replay and to apply to all CDE access. Detect accounts without MFA using Security Hub/Config.

Practical implementation

How this control is implemented in each reference architecture:

Require MFA for every path into the account and CDE, and flag anything that lacks it, a high-impact quick win against stolen credentials.

  1. Enable MFA on the account root user and on every IAM user, and require MFA when assuming IAM roles. (If you later adopt IAM Identity Center, enforce MFA there too.)
    Account access IAM
  2. Require MFA for sensitive/CDE actions via IAM policy conditions (aws:MultiFactorAuthPresent).
    App tier (CDE) / Data tier (CDE) IAM
  3. Detect any account or user without MFA with Security Hub / Config controls (IAM.*).
    Account-wide detection Security Hub AWS Config

How to validate: Security Hub IAM MFA controls pass, root and all IAM users have MFA, and a CDE action attempted without MFA is denied by the policy condition.

Avoid: Enforcing MFA only at console login. Also require it for sensitive API actions; a stolen access key bypasses console-only MFA.

Single-account, 3-tier →

Enforce MFA centrally for access to all accounts, back it with policy, and monitor MFA posture org-wide.

  1. Enforce MFA centrally through IAM Identity Center for access to every account, preferring phishing-resistant factors.
    Identity / security account → PCI OU IAM Identity Center AWS Organizations
  2. Back it with an SCP on the PCI OU that denies actions without MFA present.
    PCI OU (guardrail) AWS Organizations
  3. Monitor MFA posture org-wide from the delegated-admin Security Hub.
    Security tooling account Security Hub

How to validate: Identity Center requires MFA for all accounts, the SCP denies a no-MFA action test, and Security Hub shows MFA compliant across the PCI OU.

Avoid: Configuring MFA per account. Coverage gaps appear; enforce centrally through Identity Center and an OU-level SCP.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine network/system configurations to verify MFA is required for all non-console administrative access into the CDE and for all non-console access into the CDE (8.4.1.a, 8.4.2.a).
  • Observe personnel/administrators logging into the CDE to verify MFA is required (8.4.1.b, 8.4.2.b).
  • Examine MFA configurations to verify the system is not susceptible to replay and grants access only after all factors succeed (8.5.1.a, 8.5.1.b, 8.5.1.d).

Evidence in AWS

  • MFA enabled in IAM Identity Center and on the root user (Config/Security Hub evidence).
  • IAM policies with the aws:MultiFactorAuthPresent condition for CDE access.
  • Resolved Security Hub findings on MFA (IAM.*).

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 8.4 — Administrative and all non-console access into the CDE cannot be obtained by the use of a single authentication factor.
  • 8.5 — MFA systems are resistant to attack and strictly control any administrative overrides.

AWS services

AWS IAM AWS IAM Identity Center AWS Security Hub

Learning resources

References

  • AWS Security Maturity Model: MFA everywhere
  • PCI DSS v4.0.1 Requirements 8.4, 8.5