Scoutsuite: Add check for hardware based MFA for the root account in AWS

[prisas]

_This enhancement is for AWS._

Description

There is currently no check to verify if the MFA set for the root account is hardware based. AS described in the CIS Benchmark 1.2.0, the root account should have MFA enabled and it should also be hardware based.

For what I have been able to research, there are two different API calls to get the MFA devices.

The first one is list-mfa-devices (https://docs.aws.amazon.com/cli/latest/reference/iam/list-mfa-devices.html) which returns a list with ALL MFA devices associated to an account.

The second one is list-virtual-mfa-devices (https://docs.aws.amazon.com/cli/latest/reference/iam/list-virtual-mfa-devices.html) which returns a list of ONLY the virtual MFA devices associated to an account.

It should be possible to compare the result of both API calls and determine whether or not the root account has a hardware based MFA.

Additional context

Adding this check would benefit the PR #679

The following Amazon Documentation link provides more information about hardware and virtual MFA devices: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_checking-status.html

[ramimac]

Based on my read, it may be even easier to just call list-mfa-devices, and then check for UserName = root, and SerialNumber not being an arn (as per https://docs.aws.amazon.com/cli/latest/reference/iam/list-mfa-devices.html, ARNs are used for Virtual, not for hardware). I'm not setup to test however

[prisas]

That's a good idea @ramimac
Will try to implement it by checking if UserName = root and SerialNumber != arn.

Thanks for the idea!

[x4v13r64]

Based on my read, it may be even easier to just call list-mfa-devices, and then check for UserName = root

This is not possible, because list-mfa-devices cannot be called for the root account (as it does not have a UserName field).

[x4v13r64]

Closing, implemented in https://github.com/nccgroup/ScoutSuite/pull/679.