line 417: [: user/XXXX.XXXX: unary operator expected about prowler

[toniblyx]

Thanks @virtualjj, as you say there I didn't find a query to figure out if hardware MFA is used so I queried for just MFA which is also good and pretty valid check. I'm fixing it now as you suggest and also adding a comment to clarify that, in case of OK, it is Virtual MFA.

[toniblyx]

as you say, running:
aws iam get-account-summary | grep MFA

I get:
"MFADevicesInUse": 1,
"MFADevices": 1,
"AccountMFAEnabled": 1,

In my case is also use virtual MFA, so no way to see if it is hw or not.

[virtualjj]

Cool - I raised a support request with AWS to see if there is a workaround for this and will update as soon as I get an answer.

Thanks again for this very helpful project!

[toniblyx]

Thanks @virtualjj I will also go ahead and change the check command with this one which seems to be more accurate despite we don't know if it is HW or SW: aws iam get-account-summary |grep AccountMFAEnabled | awk -F":\ " '{ print $2 }'|sed 's/,//'

[toniblyx]

@virtualjj just commited the change, I have tested it in two accounts and it works. You can test it now. Glad you find it helpful.

[virtualjj]

Tested and confirmed:

I think this is a reasonable message since the hardware MFAs listed as supported by AWS have synchronization issues which isn't worth the trouble in my opinion.

I did receive a reply from AWS support that root MFA API / CLI calls are limited for security reasons citing this resource:

http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_cliapi.html

The workaround proposed by AWS support requires having paid support for Trusted Advisor and these commands that I wasn't able to test since my dev AWS account doesn't have paid support:

sudo yum install jq

check_id=$(aws support describe-trusted-advisor-checks --language en --region us-east-1 | jq -r '.checks[] | select(.name == "MFA on Root Account") | .id')

aws support describe-trusted-advisor-check-result --check-id "$check_id" --region us-east-1 | jq -r '.result.status'

[toniblyx]

I have checked those commands with one of our paid support accounts and I don't think it adds more value or information to what I currently have with the existing check. Another reason to write prowler was to not to depend on your support status to get good advises about security. Thanks for your time looking at it @virtualjj

[virtualjj]

Awesome and agreed - thanks again!