ThreatClaw · Investigation Playbook

Compliance: Authentification multifacteur obligatoire sur les comptes à privilèges

OPA / RegoRule mfa_privileged_accounts

  1. Confirm the non-compliance

    Control: **Authentification multifacteur obligatoire sur les comptes à privilèges** (category: compliance). Platform(s) / resource(s): config, iac. Severity: **medium**. Verify the infrastructure resource genuinely violates the control and that it is not a documented, accepted exception.

  2. Compliance frameworks impacted

    • Required directly by: ReCyF

  3. Blast radius (scope)

    Search for the same non-compliance across other resources of the same type in the IaC and the cloud estate: a misconfiguration is rarely isolated.

  4. IaC remediation (informational, HITL)

    ⚠️ No automatic action. Fix the configuration at the source in the infrastructure code (Terraform / CloudFormation / Kubernetes manifest / ARM) per the control, then re-evaluate with the policy engine (OPA) after the fix. Human review required.