Open menu
-->

Enable Security Challenge Questions for your AWS Account

Cloud Conformity allows you to automate the auditing process of this resolution page. Register for a 14 day evaluation and check your compliance level for free!

Start a Free Trial Product features
Security

Risk level: Very High (not tolerated)

Ensure your AWS account is configured to use security challenge questions so Amazon can use these questions to verify your identity in case your account become compromised or if you just need to contact their customer service for help.

By default there are no security challenge questions set for your AWS account. Enabling and configuring security challenge questions will add an extra layer of security to your account. Note: Amazon does not currently provide an API for working with the security challenge questions, therefore you need to verify and configure the feature manually using the AWS Management Console and acknowledge this action within “Security Challenge Questions” rule settings available on Cloud Conformity console.

Audit

To determine if the Security Challenge Questions feature is enabled within your AWS account, perform the following:

Note: Verifying security challenge questions configuration using AWS Command Line Interface (CLI)/AWS API is not currently supported, the feature configuration needs to be checked manually through AWS Management Console.

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to your AWS account settings page at https://console.aws.amazon.com/billing/home?#/account/.

03 Scroll down to Configure Security Challenge Questions section and verify the feature configuration. If there are no security challenge questions set and the following status is displayed: “Security questions are currently not enabled.”, the feature is not currently enabled and configured to identify you as the account owner in case the account is compromised.

Remediation / Resolution

To secure your AWS account identity by enabling and configuring security challenge questions, perform the following:

Note: Setting your account security challenge questions using AWS Command Line Interface (CLI)/AWS API is not currently supported, the feature needs to be configured manually through AWS Management Console.

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to your AWS account settings page at https://console.aws.amazon.com/billing/home?#/account/.

03 Scroll down to Configure Security Challenge Questions section and click the Edit link:

Configure Security Challenge Questions section and click the Edit link

to display the security challenge questions configuration form.

04 Select three different questions made available by Amazon and provide the appropriate answers to the selected questions, e.g.

Select three different questions made available by Amazon and provide the appropriate answers to the selected questions

To make sure you won't lose them, write down and store the answers in a secure but accessible location.

05 Click the Update button to save the changes.

References

Publication date May 24, 2016