[New Check]: IAM policy allows sensitive actions without requiring MFA condition

Existing check search

• I have searched existing issues, Prowler Hub, and the public roadmap, and this check does not already exist.

Provider

AWS

New provider name

No response

Service or product area

iam

Suggested check name

iam_policy_sensitive_actions_require_mfa_condition

Context and goal

IAM policies (customer-managed, inline, and role trust policies) that grant sensitive/escalation-capable actions — iam:CreateAccessKey, iam:AttachUserPolicy, iam:PutUserPolicy, sts:AssumeRole, iam:PassRole, without a Condition block requiring aws:MultiFactorAuthPresent.

Expected behavior

PASS: every statement granting one of the sensitive actions above includes a Condition (Bool or BoolIfExists) requiring aws:MultiFactorAuthPresent = true.

FAIL: at least one statement grants a sensitive action without that MFA condition present.

References

AWS docs on aws:MultiFactorAuthPresent as a condition key: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-multifactorauthpresent

I have a working Python reference implementation with test coverage at github.com/Bims-creator/iam-lint (see iam_lint/scanner.py, has_mfa_condition() and MFA_SENSITIVE_ACTIONS), which I'm happy to adapt to Prowler's check/metadata structure if this is approved.

Suggested severity

Medium

Additional implementation notes

No response