> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Console sign in without mfa remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact steps to monitor “AWS Console sign-in without MFA” using CloudWatch via the AWS Management Console.

        ***

        ### 1. Make sure CloudTrail is enabled and sending logs to CloudWatch Logs

        1. In the AWS console, go to **CloudTrail**.
        2. In the left menu, select **Trails**.
        3. If you don’t have a trail:
           * Click **Create trail**.
           * Name it (e.g., `org-trail`).
           * Under **Storage location**, choose/create an S3 bucket.
           * Under **CloudWatch Logs**, check **Enabled**.
           * Choose/Create a **Log group** (e.g., `/aws/cloudtrail/management`).
           * Choose/Create an IAM role for CloudWatch Logs.
           * Turn on **Management events** (Read + Write).
           * Click **Create trail**.
        4. If you already have a trail:
           * Click your trail name.
           * Under **CloudWatch Logs**, click **Edit**.
           * Enable **CloudWatch Logs** and select/create a log group.
           * Save.

        You now have CloudTrail events (including ConsoleLogin) going into a CloudWatch Logs log group.

        ***

        ### 2. Create a Metric Filter for “Console sign-in without MFA”

        1. Go to **CloudWatch** in the console.

        2. In the left menu, click **Logs** > **Log groups**.

        3. Click the log group used by CloudTrail (e.g., `/aws/cloudtrail/management`).

        4. Go to the **Metric filters** tab.

        5. Click **Create metric filter**.

        6. In **Filter pattern**, use:

           ```text theme={null}
           { ($.eventName = "ConsoleLogin") && ($.responseElements.ConsoleLogin = "Success") && ($.additionalEventData.MFAUsed = "No") }
           ```

        7. Click **Next**.

        8. Under **Assign metric**, configure:
           * **Filter name**: `ConsoleLoginWithoutMFA`
           * **Metric namespace**: `Security/CloudTrail`
           * **Metric name**: `ConsoleLoginWithoutMFA`
           * **Metric value**: `1`

        9. Click **Next**, then **Create metric filter**.

        This creates a metric that increments when there is a successful console login without MFA.

        ***

        ### 3. Create a CloudWatch Alarm on that metric

        1. Still in **CloudWatch**, go to **Alarms** > **All alarms**.
        2. Click **Create alarm**.
        3. Click **Select metric**.
        4. Navigate to the metric you just created:
           * **Custom namespaces** > `Security/CloudTrail` > `Metrics with no dimensions` > `ConsoleLoginWithoutMFA`.
        5. Select the metric and click **Next**.
        6. Set the **Statistic** to `Sum`.
        7. Define the threshold, for example:
           * **Period**: `5 minutes`
           * **Threshold type**: `Static`
           * **Whenever Sum is >= 1**
        8. Click **Next**.
        9. Under **Notification**, choose or create an **SNS topic**:
           * E.g., **Create new topic** → name `security-alerts` → add email addresses.
           * Confirm the subscription via the email you receive.
        10. Click **Next**, give the alarm a name (e.g., `Alert-ConsoleLogin-Without-MFA`), and optionally a description.
        11. Click **Create alarm**.

        ***

        You now have monitoring in place: any successful AWS Console login without MFA will generate a CloudTrail event, match the metric filter, increment the metric, and trigger a CloudWatch alarm that notifies you via SNS.
      </Accordion>

      <Accordion title="Using CLI">
        Below are step‑by‑step AWS CLI instructions to monitor AWS console sign‑ins **without MFA** using CloudWatch, based on CloudTrail logs.

        Assumptions:

        * You already have a CloudTrail trail delivering events to a CloudWatch Logs log group (replace names as needed).
        * Region: `us-east-1` (change where appropriate).

        ***

        ## 1. Identify your CloudTrail log group

        If you don’t know it, list log groups and look for the one used by CloudTrail:

        ```bash theme={null}
        aws logs describe-log-groups \
          --log-group-name-prefix "/aws/cloudtrail" \
          --region us-east-1
        ```

        Assume it is:

        ```text theme={null}
        /aws/cloudtrail/logs
        ```

        ***

        ## 2. Create a CloudWatch Logs metric filter

        This filter finds `ConsoleLogin` events where:

        * `responseElements.ConsoleLogin = "Success"`
        * `additionalEventData.MFAUsed = "No"`

        Create the metric filter:

        ```bash theme={null}
        aws logs put-metric-filter \
          --log-group-name "/aws/cloudtrail/logs" \
          --filter-name "ConsoleSignInWithoutMFA" \
          --filter-pattern '{ ($.eventName = "ConsoleLogin") && ($.responseElements.ConsoleLogin = "Success") && ($.additionalEventData.MFAUsed = "No") }' \
          --metric-transformations \
              metricName="ConsoleSignInWithoutMFA",metricNamespace="CloudTrailMetrics",metricValue="1" \
          --region us-east-1
        ```

        Verify it:

        ```bash theme={null}
        aws logs describe-metric-filters \
          --log-group-name "/aws/cloudtrail/logs" \
          --region us-east-1
        ```

        ***

        ## 3. Create an SNS topic for alerts (optional but typical)

        ```bash theme={null}
        aws sns create-topic \
          --name "ConsoleSignInWithoutMFA-Alerts" \
          --region us-east-1
        ```

        Capture the returned TopicArn, e.g.:

        ```text theme={null}
        arn:aws:sns:us-east-1:111122223333:ConsoleSignInWithoutMFA-Alerts
        ```

        Subscribe an email endpoint:

        ```bash theme={null}
        aws sns subscribe \
          --topic-arn arn:aws:sns:us-east-1:111122223333:ConsoleSignInWithoutMFA-Alerts \
          --protocol email \
          --notification-endpoint your-email@example.com \
          --region us-east-1
        ```

        Confirm the subscription from your email inbox.

        ***

        ## 4. Create a CloudWatch alarm on the metric

        This example alarms if at least 1 such event occurs in a 5‑minute period:

        ```bash theme={null}
        aws cloudwatch put-metric-alarm \
          --alarm-name "ConsoleSignInWithoutMFA-Alarm" \
          --alarm-description "Alarm when an AWS Console sign-in occurs without MFA" \
          --metric-name "ConsoleSignInWithoutMFA" \
          --namespace "CloudTrailMetrics" \
          --statistic Sum \
          --period 300 \
          --evaluation-periods 1 \
          --threshold 1 \
          --comparison-operator GreaterThanOrEqualToThreshold \
          --treat-missing-data notBreaching \
          --alarm-actions arn:aws:sns:us-east-1:111122223333:ConsoleSignInWithoutMFA-Alerts \
          --region us-east-1
        ```

        ***

        ## 5. Test

        1. Have a test IAM user without MFA perform a console login.
        2. Wait a few minutes for CloudTrail → CloudWatch Logs → Metric → Alarm pipeline to process.
        3. Check the alarm status and SNS email.

        ```bash theme={null}
        aws cloudwatch describe-alarms \
          --alarm-names "ConsoleSignInWithoutMFA-Alarm" \
          --region us-east-1
        ```

        This fully implements “AWS Console Sign In Without MFA Should Be Monitored” using CloudWatch and AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To monitor AWS console sign-ins **without MFA** using **CloudWatch + Python (boto3)**, you need to:

        1. Ensure CloudTrail is enabled and delivering to a CloudWatch Logs group
        2. Create a **metric filter** in CloudWatch Logs to detect non‑MFA console logins
        3. Create a **CloudWatch alarm** on that metric

        Below are the steps and example Python code.

        ***

        ## 1. Prerequisites

        * AWS CloudTrail enabled (at least one trail, logging Management events)
        * Trail configured to send logs to a CloudWatch Logs log group (e.g., `/aws/cloudtrail/management`)
        * An IAM role/user with permissions for:
          * `logs:PutMetricFilter`, `logs:DescribeLogGroups`
          * `cloudwatch:PutMetricAlarm`
          * `cloudtrail:DescribeTrails`

        ***

        ## 2. Metric Filter Pattern for Console Sign‑In Without MFA

        The relevant CloudTrail event is `ConsoleLogin` in `signin.amazonaws.com`.\
        Non-MFA console logins typically have `"additionalEventData": {"MFAUsed":"No"}` or just `"MFAUsed":"No"`.

        Use a filter pattern like:

        ```text theme={null}
        { ($.eventName = "ConsoleLogin") && ($.eventSource = "signin.amazonaws.com") && ($.additionalEventData.MFAUsed = "No") && ($.responseElements.ConsoleLogin = "Success") }
        ```

        Adjust for your environment if you also want to include failed logins.

        ***

        ## 3. Python Script (boto3) to Create Metric Filter + Alarm

        ```python theme={null}
        import boto3
        import sys

        region = "us-east-1"  # change to your region
        log_group_name = "/aws/cloudtrail/management"  # change to your CloudTrail log group
        metric_namespace = "SecurityMonitoring"
        metric_name = "ConsoleLoginsWithoutMFA"
        alarm_name = "Alert-Console-Login-Without-MFA"
        alarm_topic_arn = "arn:aws:sns:us-east-1:123456789012:SecurityAlerts"  # change to your SNS topic ARN

        logs_client = boto3.client("logs", region_name=region)
        cw_client = boto3.client("cloudwatch", region_name=region)

        def create_metric_filter():
            filter_pattern = '{ ($.eventName = "ConsoleLogin") && ($.eventSource = "signin.amazonaws.com") && ($.additionalEventData.MFAUsed = "No") && ($.responseElements.ConsoleLogin = "Success") }'

            print(f"Creating/updating metric filter on log group: {log_group_name}")
            logs_client.put_metric_filter(
                logGroupName=log_group_name,
                filterName="ConsoleLoginWithoutMFAFilter",
                filterPattern=filter_pattern,
                metricTransformations=[
                    {
                        "metricName": metric_name,
                        "metricNamespace": metric_namespace,
                        "metricValue": "1",
                        "defaultValue": 0.0
                    }
                ]
            )

        def create_alarm():
            print(f"Creating/updating CloudWatch alarm: {alarm_name}")
            cw_client.put_metric_alarm(
                AlarmName=alarm_name,
                AlarmDescription="Triggers when there is at least one AWS console login without MFA.",
                Namespace=metric_namespace,
                MetricName=metric_name,
                Statistic="Sum",
                Period=300,  # 5 minutes
                EvaluationPeriods=1,
                Threshold=1,
                ComparisonOperator="GreaterThanOrEqualToThreshold",
                TreatMissingData="notBreaching",
                AlarmActions=[alarm_topic_arn],
                OKActions=[alarm_topic_arn],
                Unit="Count"
            )

        if __name__ == "__main__":
            try:
                create_metric_filter()
                create_alarm()
                print("Metric filter and alarm configured successfully.")
            except Exception as e:
                print(f"Error: {e}")
                sys.exit(1)
        ```

        ***

        ## 4. High-Level Remediation Steps

        1. Confirm CloudTrail is sending logs to `log_group_name`.
        2. Run the Python script (with correct region, log group, and SNS topic).
        3. Test: perform a console login **without MFA** (from a test account) and confirm:
           * Metric `SecurityMonitoring/ConsoleLoginsWithoutMFA` increments
           * Alarm `Alert-Console-Login-Without-MFA` goes into `ALARM` state and sends a notification via SNS.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_sns_topic" "console_signin_without_mfa_alerts" {
          name = "ConsoleSignInWithoutMFA-Alerts"
        }

        resource "aws_cloudwatch_event_rule" "detect_console_signin_without_mfa" {
          name        = "DetectConsoleSignInWithoutMFA"
          description = "Detects AWS console sign-ins performed without using MFA"

          event_pattern = jsonencode({
            source      = ["aws.signin"]
            "detail-type" = ["AWS Console Sign In via CloudTrail"]
            detail = {
              eventName = ["ConsoleLogin"]
              additionalEventData = {
                MFAUsed = ["No"]
              }
            }
          })
        }

        resource "aws_cloudwatch_event_target" "console_signin_without_mfa_to_sns" {
          rule      = aws_cloudwatch_event_rule.detect_console_signin_without_mfa.name
          target_id = "ConsoleSignInWithoutMFA-Target"
          arn       = aws_sns_topic.console_signin_without_mfa_alerts.arn
        }

        resource "aws_sns_topic_subscription" "console_signin_without_mfa_email" {
          topic_arn = aws_sns_topic.console_signin_without_mfa_alerts.arn
          protocol  = "email"
          endpoint  = "ALERT_EMAIL_ADDRESS@example.com" # replace with the email to receive alerts
        }
        ```

        This adds new resources only; existing resources are not replaced. You still need an active CloudTrail trail in this region logging management events for the rule to match events.

        Verification: `terraform plan` should show one `aws_sns_topic`, one `aws_cloudwatch_event_rule`, one `aws_cloudwatch_event_target`, and one `aws_sns_topic_subscription` to be created.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>