MFA Is Enabled. Why Is Your AWS Account Still Exposed?
A company can report 95% MFA coverage and still be exposed by one unprotected admin, a 400-day-old key, or a GitHub OIDC role with no repository restrictions.
Authentication security is frequently reduced to one metric: what percentage of users have MFA? MFA is critical, but AWS authentication also includes root-account protection, long-lived access keys, dormant credentials, IAM users with console and programmatic access, federated identities, OIDC providers, SAML roles, AWS Identity Center permission sets and cross-account role assumptions.
OWASP A07 covers failures that allow attackers to impersonate users, compromise credentials or bypass authentication controls.
95% MFA coverage can still leave you exposed
A company may report strong MFA adoption while still having:
- One administrator without MFA.
- Root access without complete protection.
- A 400-day-old access key.
- An unused but active CI/CD credential.
- A GitHub OIDC role without repository or branch restrictions.
- A federated permission set with broad administrative access.
Attackers do not need to compromise the average user. They need to find the weakest high-impact identity.
Authentication is an identity lifecycle
The risk of machine identities
CI/CD roles and workload identities cannot enter a human MFA code. Their protection depends instead on short-lived credentials and restrictive trust-policy conditions — which is exactly where an unconditioned OIDC trust becomes dangerous.
How Securitain prioritizes authentication findings
A user without MFA is important. A user without MFA who also has administrator access, old access keys and the ability to assume external roles is much more important. That contextual prioritization is where Securitain differentiates. It analyzes MFA status, administrative and root posture, console-enabled users, access-key age and last-used timestamps, unused and stale credentials, the privilege behind each key, external role trusts, OIDC and SAML federation risks, Identity Center permission sets, and credential blast radius.
Recommended remediation sequence
- 1Root account.
- 2Unprotected administrators.
- 3Active stale credentials.
- 4Federation and OIDC trust weaknesses.
- 5Dormant users.
- 6General MFA coverage.
Do not measure authentication security only by counting MFA-enabled users. Measure the identities that can cause the greatest damage when compromised.
Securitain provides read-only AWS IAM and security-posture analysis through temporary STS sessions. It helps teams understand identities, effective permissions, attack paths, resource exposure and remediation opportunities without requiring permanent administrative access to the customer's AWS account.