Orca MFA Enforcement Skill

Answers the question: "Which of our users can sign in without MFA, and how do we close that gap without locking anyone out?"

A password-only user is one phish away from being an attacker. This skill sweeps an account or business unit for users whose console sign-in is not protected by MFA, ranks them by identity risk score, and walks the user through remediation with a non-destructive path (guide: per-user enrollment instructions and owner notifications) and a destructive path (enforce: apply a require-MFA policy) that is always gated behind explicit confirmation — because no cloud lets an admin enroll MFA on a user's behalf, and enforcement locks the user out until they enroll themselves. Where usage data shows a console password nobody uses, it proposes the better fix: remove the unused console access instead of chasing enrollment.

The core signal: every user Orca models carries a pre-computed MfaActive boolean on the asset itself — one shared field across all six supported providers: AWS, Azure (incl. Entra ID), GCP (via Google Workspace), Alibaba Cloud, OCI, and Tencent Cloud. It is tri-state: true (covered), false (not covered), and null (no signal — never treat as "no MFA", with one exception: on root it is fail-closed, see bucket 1); in live payloads a null usually shows up as the field being entirely absent, which means exactly the same thing.

What each provider exposes differs sharply, and a missing capability is a product fact rather than something to work around. Read references/providers.md before improvising for a provider: it holds the capability matrix (MFA signal, console gate, alert rules, cloud logs, privilege signal, whether remove-access is reachable), the enumeration models, the no-MFA alert types, and the per-provider enforcement mechanics.

MFA is a console-sign-in control. Access keys and API tokens are not protected by it, so a user with no console access has nothing for this skill to fix — that's a key-hygiene or cleanup problem, not an MFA gap. The provider alert rules gate on exactly this, and so does this skill.

Usage