Product: SecurityHub
Applies to: Customer SecurityHub administrators
Multi-factor authentication (MFA) can be configured for domains that are not using SSO.
Note: This option is only available if you have a valid domain associated with your organization. If you do not have a valid domain associated with your organization, you can request a domain be added. For more information, see Managing domains.
When you add an MFA rule, as part of the configuration, you can specify test users. The rule will initially be created in the testing mode, meaning that only the test users will be subject to the rule This allows you to ensure that the rule is working properly before making it available to all users in the configured domains.
MFA rules can have one of the following statuses.
- Setup - The connector has one or more domains associated with it that can be tested using the test users. The connector is not live.
- Active - The connector is live and in use.
- Inactive - The connector does not have any domains associated with it.
Your contract determines which features are available and which roles can access them. Note that compliance admins only have view rights to the available features.
How to configure MFA
- From within SecurityHub, click Login Security.
- Click MFA.
- In the Rule Name field, enter a name for the rule.
- In the Select Verification field, select one of the following options:
- To require that all users verify their identity when logging in, select Always Require Verification. If users are required to verify their identities based on others risks, they will not be asked to verify again.
- To require users to enter a code every time they log in, select Send Verification Codes by Email. The code will be sent to the user's email every time they log in.
- In the Contact Email Address field, provide an email address for the person or group that can assist users with issues that prevent them from logging in.
- Click Next.
- In the Domains field, enter the domains to which this rule will apply. Click Select all domains to display all domains. Note that domains that are associated with an SSO connector are not shown.
- In the Test Users field, enter the email addresses of the users that will test the rule. The users must be part of the domain. A maximum of 15 test users can be added.
- Click Next.
- Review the rule details and click Add.
How to edit a rule
- From within SecurityHub, click Login Security.
- Click MFA.
- In the Actions column of the rule you want to edit, click the edit icon.
- Click Domain Associations to update the rule status and associated domains.
- In the Status field, select the status.
- Setup - The rule has domains associated with it and can be tested. It is not active.
- Inactive - No domains are associated with the rule.
- Active - The rule is in use.
- Update domains and test users as necessary.
- Click Rule Details to change the rule action and countries affected by this rule.
- Make changes and click Save.
How to delete a rule
Only rules that are inactive, that is, they do not have domains associated with it, can be deleted.
- From within SecurityHub, click Login Security.
- Click MFA.
- Ensure that the rule that you want to delete is in the inactive state. If it is not in the inactive state, in the Actions column, click the edit icon, change the status to inactive and click Save.
- In the Actions column of the rule you want to delete, click the trashcan icon.
- Click Delete to confirm
How to view rule details
- From within SecurityHub, click Login Security.
- Click Access Control.
- Click the name of the rule.
- Click Back to return to the list of rules.