# AWS Config compliance result for the managed rule proving every IAM user with a console password has MFA enabled

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-mfa-enabled-console-access

Recipe id: `config-mfa-enabled-console-access` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-APM`
- control `ia-2`

## Collection

Kind: `config-rule`

```sh
# mfa-enabled-for-iam-console-access
aws configservice get-compliance-details-by-config-rule --config-rule-name mfa-enabled-for-iam-console-access --compliance-types NON_COMPLIANT
# configuration-recorder-status
aws configservice describe-configuration-recorder-status
# mfa-enabled-for-iam-console-access-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names mfa-enabled-for-iam-console-access
```

## Expected output

EvaluationResults array; empty NON_COMPLIANT set means all console-enabled IAM users have MFA. Managed rule identifier: MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

## Assertions

- {"field":"mfa-enabled-for-iam-console-access.EvaluationResults","op":"count_eq","value":0,"controls":["ia-2"],"description":"No IAM user with console access lacks MFA."}
- {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["ia-2"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."}
- {"field":"mfa-enabled-for-iam-console-access-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["ia-2"],"description":"mfa-enabled-for-iam-console-access has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"mfa-enabled-for-iam-console-access-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["ia-2"],"description":"mfa-enabled-for-iam-console-access has a successful evaluation on record."}

## GovCloud

AWS Config and this managed rule are available in AWS GovCloud (US); resource ARNs use partition arn:aws-us-gov

## Notes

Substitute your deployed rule name if it differs from the default. An empty NON_COMPLIANT result is the pass condition. Pair with the IAM_USER_MFA_ENABLED rule to also catch programmatic users. MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS is COMPLIANT for any enabled device, including a virtual TOTP app; whether the factor is phishing-resistant (the IA-02 (01)/(02) guidance), and whether workforce console access runs through IAM users at all rather than IAM Identity Center, are judgements outside this output — filed under IA-02 base for that reason, and nothing here partitions privileged from non-privileged accounts.

## References

- {"title":"AWS Config managed rule: mfa-enabled-for-iam-console-access (MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS, periodic, AWS::IAM::User)","url":"https://docs.aws.amazon.com/config/latest/developerguide/mfa-enabled-for-iam-console-access.html"}
- {"title":"AWS Config managed rule: iam-user-mfa-enabled — the companion rule covering users without console access","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-user-mfa-enabled.html"}