Skip to main content

OCI IAM Console Users Should Have MFA Enforced

More Info:​

MFA should be enforced for every user with console login capability. Console access without MFA is vulnerable to phishing and credential-stuffing attacks.

Risk Level​

High

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • GDPR
  • HIPAA
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are step‑by‑step instructions to remediate “OCI IAM Console Users Should Have MFA Enforced” using the OCI Console, so that it is actually enforced (not just optional) and visible to IAM monitoring/Cloud Guard.

1. Identify the Identity Domain Used for Console Logins​

  1. Sign in to the OCI Console as a tenancy admin.
  2. Open the navigation menu → Identity & Security → Identity Domains.
  3. Locate the identity domain(s) where your console users exist (often named Default, or similar).
  4. Click the target identity domain name to manage its settings.

2. Configure MFA Factors in the Identity Domain​

  1. Inside the identity domain, go to Security → Multi-Factor Authentication (or Security → Factors, depending on version).
  2. Under Available Factors, ensure at least one of these is Enabled:
    • Time-based One-Time Password (TOTP) (e.g., Google Authenticator, Microsoft Authenticator)
    • Email OTP or SMS OTP (if allowed by your policy)
  3. Save any changes.

This defines what MFA methods users can register.

3. Enforce MFA via Sign-On Policy​

You now make MFA mandatory for interactive console access.

  1. In the same identity domain, go to Security → Sign-on Policies.
  2. Either edit the existing default sign-on policy or create a new policy:
    • Click Create Sign-on Policy (if creating new).
    • Name it (e.g., Require-MFA-For-Console).
  3. Add a Rule (or edit an existing rule) that matches all interactive console users, for example:
    • Conditions:
      • Client Type: Browser (or All if you want broad coverage).
      • IP Range / Network Perimeter: as required (or leave broad for all).
      • User Group: choose groups that represent console users (e.g., Administrators, OCI-Console-Users) or All users if every human user must have MFA.
    • Actions / Access:
      • Set Require multi-factor authentication = Yes (or choose the specific factor set if prompted).
  4. Ensure rule order is correct:
    • Rules are evaluated top-down. Place the MFA-required rule above any rules that might allow access without MFA.
  5. Save the sign-on policy and make sure it is Active.

This step is what actually fixes the “MFA not enforced” finding.

4. Require Existing Users to Register MFA​

Enforcement will prompt users, but you can also verify/assist:

  1. In the identity domain, go to Users.
  2. Pick a user → check Security / Multifactor Authentication or Factors tab:
    • Confirm if they already have an enrolled factor (e.g., TOTP).
  3. If not enrolled:
    • Tell users to sign in to the OCI Console.
    • On next sign-in, due to the new sign-on policy, they’ll be guided to register MFA (e.g., scan QR code with an authenticator app).
  4. For critical/admin users, you can test:
    • Log in as that user (or with a test user in same groups) to verify you’re forced to set up MFA and use it.

5. Confirm with OCI IAM Monitoring / Cloud Guard​

If the finding came from Cloud Guard or Security Advisor, verify remediation:

  1. Go to Identity & Security → Cloud Guard.
  2. Under Detected Problems (or Targets → Problems):
    • Filter by resource type IAM, or by the specific problem name (e.g., OCI IAM Console Users Should Have MFA Enforced).
  3. After the new sign-on policy has been active and users start registering MFA, let Cloud Guard re-evaluate (or manually Recalculate / Re-evaluate if available).
  4. Confirm the problem status moves to Resolved or No problems for IAM console MFA.

6. Optional: Tighten for Admin / Privileged Groups​

If you want extra assurance:

  1. Create a separate sign-on policy specifically targeting:
    • Admin groups: Administrators, SecurityAdmins, NetworkAdmins, etc.
  2. For these rules:
    • Always require MFA (no exceptions by IP or network).
  3. Place these rules at the top in the sign-on policy order.

Summary of Remediation via Console:

  • Enable at least one MFA factor in the identity domain.
  • Create or edit a Sign-On Policy to require MFA for console access for all (or all human) IAM users.
  • Ensure rule ordering enforces MFA, and confirm via user login test.
  • Verify in Cloud Guard / IAM Monitoring that the “MFA enforced” check is now passing.
Using CLI

In OCI you can monitor MFA status with the CLI, but you cannot actually “turn on” or enroll MFA for a user via CLI – users must self-enroll, and enforcement is done via Identity Domain / sign‑on policies.

Below are the practical steps:

1. Prerequisites​

  • OCI CLI installed and configured with a tenancy‑admin or security‑admin–level profile:
oci setup config
  • Know your:
    • Tenancy OCID: ocid1.tenancy.oc1....
    • Home region (for IAM operations): e.g. us-phoenix-1

Export region/profile for convenience:

export OCI_CLI_REGION=us-phoenix-1
export OCI_CLI_PROFILE=DEFAULT

2. List all IAM users and check MFA status​

The user object includes a flag for MFA activation (in classic IAM tenants it’s is_mfa_activated or similar; in identity domains it’s exposed through identity‑domains APIs).

2.1 Get all users (classic IAM)​

oci iam user list \
  --all \
  --query "data[].{name:\"name\", ocid:\"id\", mfa:\"is-mfa-activated\"}" \
  --output table

To see only users without MFA:

oci iam user list \
  --all \
  --query "data[?\"is-mfa-activated\"==\`false\`].{name:\"name\", ocid:\"id\"}" \
  --output table

If you are using Identity Domains, use the identity‑domains service:

oci identity-domains user list \
  --identity-domain-id <identity_domain_ocid> \
  --all

(Then filter the returned JSON on the MFA factor attributes, which differ by domain config.)

3. Create a monitoring script​

You can schedule a simple script (OCI DevOps, Functions, or external CI) to fail compliance if any user lacks MFA.

Example (bash, classic IAM):

#!/usr/bin/env bash
set -euo pipefail

NON_MFA_USERS=$(oci iam user list --all \
  --query "data[?\"is-mfa-activated\"==\`false\`].name" \
  --raw-output)

if [ -n "$NON_MFA_USERS" ]; then
  echo "Users without MFA:"
  echo "$NON_MFA_USERS"
  exit 1   # mark as non-compliant
else
  echo "All users have MFA enabled."
fi

4. Enforce MFA (remediation)​

This part cannot be done directly via OCI CLI at per‑user level. You remediate by:

  1. Enforcing MFA via Identity Domain sign‑on policies (Console):

    • Go to: Identity & Security → Domains → select your domain.
    • Security → Sign-on policies.
    • Edit or create a policy that requires MFA for:
      • “OCI Console access” (or equivalent app),
      • All users or targeted groups.
    • Set conditions (e.g., all networks) and require at least one MFA factor.

  2. Communicating to users:

    • Notify the non‑MFA users identified by the script to log in and complete MFA enrollment.
    • Optionally, set a deadline and then:

      • Disable users who haven’t enrolled MFA:

        oci iam user update \
          --user-id <user_ocid> \
          --force --defined-tags '{}' \
          --freeform-tags '{}' \
          --lifecycle-state INACTIVE

        (Use carefully; you’re disabling the account.)

5. Optional: Wire into OCI Cloud Guard / Security Zones​

  • Enable Cloud Guard with a detector recipe that includes the “MFA not enabled for IAM users” rule (if present for your tenancy).
  • You can then use responder recipes, or a Function triggered by events, to:
    • Run the CLI monitoring script,
    • Create incidents or send notifications for non‑MFA users.

Summary:

  • Use OCI CLI to monitor MFA status and detect non‑compliant console users.
  • Use Identity Domain sign‑on policies (via Console or IAM APIs if/when available) to enforce MFA globally.
  • Users must self‑register MFA; you can optionally disable non-compliant accounts via CLI as a hard remediation step.
Using Python

Below is a practical way to monitor and flag OCI IAM console users who do not have MFA configured, using Python and the OCI SDK.

Note: MFA is enforced via IAM security policies / identity domain authentication policies, not user-by-user. What you can do with Python is:

  • Detect users without MFA
  • Push that info into logs/metrics, send notifications, or use it as an input for governance.

1. Prerequisites​

  1. Install OCI Python SDK:
pip install oci
  1. Configure your OCI credentials (one of):
    • ~/.oci/config (via oci setup config), or
    • Instance principal / resource principal if running on OCI compute / functions.

Your config file might look like:

[DEFAULT]
user=ocid1.user.oc1..aaaa...
fingerprint=xx:xx:xx:...
key_file=/path/to/private_key.pem
tenancy=ocid1.tenancy.oc1..aaaa...
region=us-ashburn-1

2. Python Script: List Users Without MFA​

This example:

  • Lists all users in your tenancy
  • For each user, checks if any TOTP MFA devices exist
  • Prints and optionally sends them to Monitoring or Notifications
import oci
from oci.config import from_file

def get_identity_client(config_profile="DEFAULT"):
    config = from_file("~/.oci/config", config_profile)
    return oci.identity.IdentityClient(config), config["tenancy"]

def list_all_users(identity_client, tenancy_ocid):
    users = []
    list_users_response = oci.pagination.list_call_get_all_results(
        identity_client.list_users,
        compartment_id=tenancy_ocid
    )
    for user in list_users_response.data:
        # Only consider active, non-deleted users
        if user.lifecycle_state == "ACTIVE":
            users.append(user)
    return users

def user_has_mfa(identity_client, user_id):
    # If this returns 0 devices, user has no TOTP MFA devices.
    devices = oci.pagination.list_call_get_all_results(
        identity_client.list_mfa_totp_devices,
        user_id=user_id
    )
    return len(devices.data) > 0

def main():
    identity_client, tenancy_ocid = get_identity_client()

    users = list_all_users(identity_client, tenancy_ocid)

    users_without_mfa = []
    for user in users:
        if not user_has_mfa(identity_client, user.id):
            users_without_mfa.append(user)

    print("Users without MFA configured (TOTP):")
    for user in users_without_mfa:
        print(f"- {user.name} ({user.id})")

    # Optional: here you can integrate with Monitoring / Notifications:
    #   - Push a custom metric
    #   - Send to OCI Logging
    #   - Publish to an OCI Notifications (ONS) topic
    #
    # Example stub:
    # send_metric_to_monitoring(len(users_without_mfa))
    # send_list_to_notifications(users_without_mfa)

if __name__ == "__main__":
    main()

3. (Optional) Push a Custom Metric to OCI Monitoring​

This lets you create an alarm such as “if number of non-MFA users > 0, send alert”.

import oci
from datetime import datetime, timezone

def send_metric_to_monitoring(non_mfa_count, namespace="security_custom", compartment_ocid=None):
    config = oci.config.from_file()
    monitoring_client = oci.monitoring.MonitoringClient(config)

    if not compartment_ocid:
        compartment_ocid = config["tenancy"]

    metric_data = oci.monitoring.models.MetricDataDetails(
        namespace=namespace,
        compartment_id=compartment_ocid,
        name="non_mfa_users_count",
        dimensions={"tenancy": compartment_ocid},
        datapoints=[
            oci.monitoring.models.Datapoint(
                timestamp=datetime.now(timezone.utc),
                value=float(non_mfa_count)
            )
        ],
        metadata={}
    )

    post_metric_data_details = oci.monitoring.models.PostMetricDataDetails(
        metric_data=[metric_data]
    )

    monitoring_client.post_metric_data(post_metric_data_details)

Call send_metric_to_monitoring(len(users_without_mfa)) from main() after you compute the list.

Then in the OCI Console:

  1. Go to Monitoring → Metrics.
  2. Select namespace security_custom.
  3. Create an alarm on non_mfa_users_count > 0 for some periods.
  4. Attach an Alarm Destination (Notifications topic → email/Slack/etc.).

4. (Optional) Send a Notification with List of Non-MFA Users​

def send_list_to_notifications(users_without_mfa, topic_ocid):
    config = oci.config.from_file()
    ons_client = oci.ons.NotificationDataPlaneClient(config)

    body_lines = ["Users without MFA:"]
    for user in users_without_mfa:
        body_lines.append(f"- {user.name} ({user.id})")
    body = "\n".join(body_lines)

    ons_client.publish_message(
        topic_id=topic_ocid,
        message_details=oci.ons.models.MessageDetails(
            title="OCI IAM: Users without MFA",
            body=body
        )
    )

Call send_list_to_notifications(users_without_mfa, "<topic_ocid>").

5. Automate the Monitoring​

  • Run this script on:
    • A VM with cron
    • OCI DevOps build job
    • As an OCI Function with a cron Events rule (converted to Functions runtime)

6. Enforcing MFA (Separate from Monitoring)​

To actually enforce MFA (beyond monitoring):

  • Classic IAM:

    • Configure MFA in your Identity Provider / Console sign-on policy (if using identity domains, use Authentication Policies and Rules).
    • Make MFA mandatory for interactive login to the Console.

  • Identity Domains (recommended):

    • Create an Authentication Policy that requires MFA for console access (or all access).
    • Optionally enforce MFA enrollment at first login.

Python can help you monitor and report, but the enforcement switch is done via console / IAM/ID domain configuration, not per-user scripting.

Using Terraform
# There is currently no Terraform argument on oci_identity_user (or any other
# OCI IAM/Identity resource) that “enforces MFA” for a user or for all console
# users; MFA enrollment/enforcement is managed via IAM security/authentication
# settings and per‑user device activation in the Console.

# You can model users:
resource "oci_identity_user" "example_user" {
  compartment_id = var.TENANCY_OCID
  name           = "EXAMPLE_USER_NAME"
  description    = "Example IAM console user"
  email          = "EXAMPLE_USER_EMAIL"
}

# But enforcing MFA for that user (or globally) must be done outside Terraform:
# – In the OCI Console, under Identity & Security → (Identity Domain / Security)
#   → Authentication settings, configure policies that require MFA for console logins.
# – For each user, register and activate an MFA device (TOTP/SMS/etc.) via the console UI.

# Because the provider does not expose an “MFA required” switch, Terraform cannot
# remediate this specific finding on the oci-identitymanagement-iam-user surface.

# Verification in Terraform:
# `terraform plan` will show no changes related to MFA enforcement, because the
# setting is not represented in the Terraform state.