How to check whether MFA is enabled for root account in AWS using boto?

Question

I am working on trusted advisor and need to check whether MFA is enabled for root level also? Its in Security section of Trusted advisor Dashboard. I am working in Python using Boto.

Answer 1

You would use the GetAccountSummary API call in IAM which is available as the get_account_summary method call in boto.iam.IAMConnection.

import boto.iam
conn = boto.iam.connect_to_region('us-east-1')
summary = conn.get_account_summary()

This returns a Python dictionary containing a lot of information about your account. Specifically, to find out if MFA is enabled;

if summary['AccountMFAEnabled']:
    # MFA is enabled
else:
    # MFA is not enabled

Answer 2

This answer updates to boto3 and assumes that you have only one account configured in your ~/.aws/config or ~/.aws/credentials file:

import boto3

client = boto3.client('iam')

if client.get_account_summary()['SummaryMap']['AccountMFAEnabled']:
    root_has_mfa = True
else:
    root_has_mfa = False

If you'd prefer to have the dictionary that get_account_summary returns, you can do that too:

import boto3

client = boto3.client('iam')

summary = client.get_account_summary()['SummaryMap']

if summary['AccountMFAEnabled']:
    root_has_mfa = True
else:
    root_has_mfa = False