MFA enforcement IAM policy bypass

An AWS-recommended IAM policy that enforced MFA on access keys could have been bypassed
due to a change implemented by AWS in November 2022 that allowed IAM users to assign
multiple MFA devices to their account. Prior to this change, an attacker that had compromised
credentials could not create and assign a new MFA device to bypass the MFA requirement as they
would need to first deactivate the user’s existing MFA device. Organisations using SSO which
enforces MFA, either via …

access access keys account aws bypass change compromised compromised credentials credentials device devices enforcement iam keys mfa november policy