AWS Identity and Access Management (IAM) | Multi-Factor Authentication

Question 1

Are there any default quota limits associated with IAM?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 1

Yes, by default your AWS account has initial quotas set for all IAM-related entities. For details see Limitations on IAM Entities and Objects.

These quotas are subject to change. If you require an increase, you can access the Service Limit Increase form via the Contact Us page, and choose IAM Groups and Users from the Limit Type drop-down list.

Question 2

What is AWS MFA?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 2

AWS multi-factor authentication (AWS MFA) provides an extra level of security that you can apply to your AWS environment. You can enable AWS MFA for your AWS account and for individual AWS Identity and Access Management (IAM) users you create under your account.

Question 3

How does AWS MFA work?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 3

AWS MFA uses an authentication device that continually generates random, six-digit, single-use authentication codes. There are two primary ways to authenticate using an AWS MFA device:

AWS Management Console users: When a user with MFA enabled signs in to an AWS website, they are prompted for their user name and password (the first factor–what they know), and an authentication code from their AWS MFA device (the second factor–what they have). All AWS websites that require sign-in, such as the AWS Management Console, fully support AWS MFA. You can also use AWS MFA together with Amazon S3 secure delete for additional protection of your S3 stored versions.

AWS API users: You can enforce MFA authentication by adding MFA restrictions to your IAM policies. To access APIs and resources protected in this way, developers can request temporary security credentials and pass optional MFA parameters in their AWS Security Token Service (STS) API requests (the service that issues temporary security credentials). MFA-validated temporary security credentials can be used to call MFA-protected APIs and resources.

Question 4

How do I help protect my AWS resources with MFA?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 4

Follow two easy steps:

1. Get an authentication device. You have two options:

Purchase a hardware device from Gemalto, a third-party provider.

Install a virtual MFA–compatible application on a device such as your smartphone.

Visit the AWS MFA page for details about how to acquire a hardware or virtual MFA device.

2. After you have an authentication device, you must activate it in the IAM console. You can also use the IAM CLI to activate the device for an IAM user.

Question 5

Is there a fee associated with using AWS MFA?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 5

AWS does not charge any additional fees for using AWS MFA with your AWS account. However, if you want to use a physical authentication device then you will need to purchase an authentication device that is compatible with AWS MFA from Gemalto, a third party provider. For more details, please visit Gemalto’s website.

Question 6

Can I have multiple authentication devices active for my AWS account?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 6

Yes. Each IAM user can have its own authentication device. However, each identity (IAM user or root account) can be associated with only one authentication device.

Question 7

Can I use my authentication device with multiple AWS accounts?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 7

No. The authentication device or mobile phone number is bound to an individual AWS identity (IAM user or root account). If you have a TOTP-compatible application installed on your smartphone, you can create multiple virtual MFA devices on the same smartphone. Each one of the virtual MFA devices is bound to a single identity, just like a hardware device. If you dissociate (deactivate) the authentication device, you can then reuse it with a different AWS identity. The authentication device cannot be used by more than one identity simultaneously.

Question 8

I already have a hardware authentication device from my place of work or from another service I use, can I re-use this device with AWS MFA?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 8

No. AWS MFA relies on knowing a unique secret associated with your authentication device in order to support its use. Because of security constraints that mandate such secrets never be shared between multiple parties, AWS MFA cannot support the use of your existing hardware authentication device. Only a compatible hardware authentication device purchased from Gemalto can be used with AWS MFA.

Purchasing an MFA Device

Question 9

I’m having a problem with an order for an authentication device using the third-party provider Gemalto’s website. Where can I get help?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 9

Gemalto’s customer service can assist you.

Question 10

I received a defective or damaged authentication device from the third party provider Gemalto. Where can I get help?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 10

Gemalto’s customer service can assist you.

Question 11

I just received an authentication device from the third party provider Gemalto. What should I do?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 11

You simply need to activate the authentication device to enable AWS MFA for your AWS account. See the IAM console to perform this task.

Provisioning a Virtual MFA Device

Question 12

What is a virtual MFA device?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 12

A virtual MFA device is an entry created in a TOTP compatible software application that can generate six-digit authentication codes. The software application can run on any compatible computing device, such as a smartphone.

Question 13

What are the differences between a virtual MFA device and physical MFA devices?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 13

Virtual MFA devices use the same protocols as the physical MFA devices. Virtual MFA devices are software based and can run on your existing devices such as smartphones. Most virtual MFA applications also allow you to enable more than one virtual MFA device, which makes them more convenient than physical MFA devices.

Question 14

Which virtual MFA applications can I use with AWS MFA?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 14

You can use applications that generate TOTP-compliant authentication codes, such as the Google Authenticator application, with AWS MFA. You can provision virtual MFA devices either automatically by scanning a QR code with the device’s camera or by manual seed entry in the virtual MFA application.

Visit the MFA page for a list of supported virtual MFA applications.

Question 15

What is a QR code?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 15

A QR code is a two-dimensional barcode that is readable by dedicated QR barcode readers and most smartphones. The code consists of black squares arranged in larger square patterns on a white background. The QR code contains the required security configuration information to provision a virtual MFA device in your virtual MFA application.

Question 16

How do I provision a new virtual MFA device?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 16

You can configure a new virtual MFA device in the IAM console for your IAM users as well as for your AWS root account. You can also use the aws iam create-virtual-mfa-device command in the AWS CLI or the CreateVirtualMFADevice API to provision new virtual MFA devices under your account. The aws iam create-virtual-mfa-device and the CreateVirtualMFADevice API return the required configuration information, called a seed, to configure the virtual MFA device in your AWS MFA compatible application. You can either grant your IAM users the permissions to call this API directly or perform the initial provisioning for them.

Question 17

How should I handle and distribute the seed material for virtual MFA devices?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 17

You should treat seed material like any other secret (for example the AWS secret keys and passwords).

Question 18

How can I enable an IAM user to manage virtual MFA devices under my account?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 18

Grant the IAM user the permission to call the CreateVirtualMFADevice API. You can use this API to provision new virtual MFA devices.

SMS MFA

Question 19

Can I still request preview access to the SMS MFA?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 19

We are no longer accepting new participants for the SMS MFA preview. We encourage you to use MFA on your AWS account by using either a hardware or virtual MFA device.

Question 20

How can I begin using the SMS option during the preview?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 20

For existing SMS MFA participants, you can navigate to the IAM console and enable SMS MFA for IAM users. The process involves entering a phone number for each IAM user. Then, when the IAM user signs in to the AWS Management Console, the user receives a six-digit security code via a standard SMS text message and must enter it when signing in.

Enabling AWS MFA Devices

Question 21

Where do I enable AWS MFA?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 21

You can enable AWS MFA for an AWS account and your IAM users in the IAM console, the AWS CLI, or by calling the AWS API.

Question 22

What information do I need to activate a hardware or virtual authentication device?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 22

If you are activating the MFA device with the IAM console then you only need the device. If you are using the AWS CLI or the IAM API then you need the following:

1. The serial number of the authentication device. The format of the serial number depends on whether you are using a hardware device or a virtual device:
   - Hardware MFA device: The serial number is on the bar-coded label on the back of the device.
   - Virtual MFA device: The serial number is the Amazon Resource Name (ARN) value returned when you run the iam-virtualmfadevicecreate command in the AWS CLI or call the CreateVirtualMFADevice API.
2. Two consecutive authentication codes displayed by the authentication device.

Question 23

My authentication device seems to be working normally, but I am not able to activate it. What should I do?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 23

Please contact us for help.

Using AWS MFA

Question 24

If I enable AWS MFA for my AWS root account or my IAM users, do they always have to use an authentication code to sign in to the AWS Management Console?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 24

Yes. The AWS root credential user and IAM users must have their MFA device with them any time they need to sign in to any AWS website.

If your MFA device is lost, damaged, stolen, or not working, you can sign in using alternative factors of authentication, deactivate the MFA device, and activate a new device. As a security best practice, we recommend that you change your root account’s password.

With virtual and hardware MFA, if your IAM users lose or damage their authentication device, or if it is stolen or stops working, you can disable AWS MFA yourself by using the IAM console or the AWS CLI.

Question 25

If I enable AWS MFA for my AWS root account or IAM users, do they always need to enter an MFA code to directly call AWS APIs?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 25

No, it’s optional. However, you must enter an MFA code if you plan to call APIs that are secured by MFA-protected API access.

If you are calling AWS APIs using access keys for your AWS root account or IAM user, you do not need to enter an MFA code. For security reasons, we recommend that you remove all access keys from your AWS root account and instead call AWS APIs with the access keys for an IAM user that has the required permissions.

Question 26

How do I sign in to the AWS Portal and AWS Management Console using my authentication device?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 26

Follow these two steps:

If you are signing in as an AWS root account, sign in as usual with your user name and password when prompted. To sign in as an IAM user, use the account-specific URL and provide your user name and password when prompted.

On the next page, enter the six-digit authentication code that appears on your authentication device.

Question 27

Does AWS MFA affect how I access AWS Service APIs?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 27

AWS MFA changes the way IAM users access AWS Service APIs only if the account administrator(s) choose to enable MFA-protected API access. Administrators may enable this feature to add an extra layer of security over access to sensitive APIs by requiring that callers authenticate with an AWS MFA device. For more information, see the MFA-protected API access documentation in more detail.

Other exceptions include S3 PUT bucket versioning, GET bucket versioning, and DELETE object APIs, which allow you to require MFA authentication to delete or change the versioning state of your bucket. For more information see the S3 documentation discussing Configuring a Bucket with MFA Delete in more detail.

For all other cases, AWS MFA does not currently change the way you access AWS service APIs.

Question 28

Can I use a given authentication code more than once?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 28

No. For security reasons, you can use each authentication code only once.

Question 29

I was recently asked to resync my authentication device because my authentication codes were being rejected. Should I be concerned?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 29

No, this can happen occasionally. AWS MFA relies on the clock in your authentication device being in sync with the clock on our servers. Sometimes, these clocks can drift apart. If this happens, when you use the authentication device to sign in to access secure pages on the AWS website or the AWS Management Console, AWS automatically attempts to resync the authentication device by requesting that you provide two consecutive authentication codes (just as you did during activation).

Question 30

My authentication device seems to be working normally, but I am not able to use it to sign in to the AWS Management Console. What should I do?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 30

We suggest you resynchronize MFA devices for your IAM user’s credentials. If you already tried to resync and are still having trouble signing in, you can sign in using alternate factors of authentication and reset your MFA device. If you are still encountering issues, contact us for help.

Question 31

My authentication device is lost, damaged, stolen, or not working, and now I can’t sign in to the AWS Management Console. What should I do?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 31

If your authentication device is associated with an AWS root account:

You can reset your MFA device on the AWS Management Console by first signing in with your password and then verifying the email address and phone number associated with your root account.

If your MFA device is lost, damaged, stolen or not working, you can sign in using alternative factors of authentication, deactivate the MFA device, and activate a new MFA device. As a security best practice, we recommend that you change your root account’s password.

If you need a new authentication device, you can purchase a new hardware authentication device from the third-party provider, Gemalto, or provision a new virtual MFA device under your account by using the IAM console.

If you have tried the preceding approaches and are still having trouble signing in, contact AWS Support.

Question 32

How do I disable AWS MFA?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 32

To disable AWS MFA for your AWS account, you can deactivate your authentication device using the Security Credentials page. To disable AWS MFA for your IAM users, you need to use the IAM console or the AWS CLI.

Question 33

Can I use AWS MFA in GovCloud?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 33

Yes, you can use AWS virtual MFA and hardware MFA devices in GovCloud.

MFA-protected API access

Question 34

What is MFA-protected API access?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 34

MFA-protected API access is optional functionality that lets account administrators enforce additional authentication for customer-specified APIs by requiring that users provide a second authentication factor in addition to a password. Specifically, it enables administrators to include conditions in their IAM policies that check for and require MFA authentication for access to selected APIs. Users making calls to those APIs must first get temporary credentials that indicate the user entered a valid MFA code.

Question 35

What problem does MFA-protected API access solve?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 35

Previously, customers could require MFA for access to the AWS Management Console, but could not enforce MFA requirements on developers and applications interacting directly with AWS service APIs. MFA-protected API access ensures that IAM policies are universally enforced regardless of access path. As a result, you can now develop your own application that uses AWS and prompts the user for MFA authentication before calling powerful APIs or accessing sensitive resources.

Question 36

How do I get started with MFA-protected API access?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 36

You can get started in two simple steps:

Assign an MFA device to your IAM users. You can purchase a hardware key fob, or download a free TOTP-compatible application for your smartphone, tablet, or computer. See the MFA detail page for more information on AWS MFA devices.

Enable MFA-protected API access by creating permission policies for the IAM users and/or IAM groups from which you want to require MFA authentication. To learn more about access policy language syntax, see the access policy language documentation.

Question 37

How do developers and users access APIs and resources secured with MFA-protected API access?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 37

Developers and users interact with MFA-protected API access both in the AWS Management Console and at the APIs.

In the AWS Management Console, any MFA-enabled IAM user must authenticate with their device to sign in. Users that do not have MFA do not receive access to MFA-protected APIs and resources.

At the API level, developers can integrate AWS MFA into their applications to prompt users to authenticate using their assigned MFA devices before calling powerful APIs or accessing sensitive resources. Developers enable this functionality by adding optional MFA parameters (serial number and MFA code) to requests to obtain temporary security credentials (such requests are also referred to as “session requests”). If the parameters are valid, temporary security credentials that indicate MFA status are returned. See the temporary security credentials documentation for more information.

Question 38

Who can use MFA-protected API access?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 38

MFA-protected API access is available for free to all AWS customers.

Question 39

Which services does MFA-protected API access work with?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 39

MFA-protected API access is supported by all AWS services that support temporary security credentials. For a list of supported services, see AWS Services that Work with IAM and review the column labeled Supports temporary security credentials.

Question 40

What happens if a user provides incorrect MFA device information when requesting temporary security credentials?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 40

The request to issue temporary security credentials fails. Temporary security credential requests that specify MFA parameters must provide the correct serial number of the device linked to the IAM user as well as a valid MFA code.

Question 41

Does MFA-protected API access control API access for AWS root accounts?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 41

No, MFA-protected API access only controls access for IAM users. Root accounts are not bound by IAM policies, which is why we recommend that you create IAM users to interact with AWS service APIs rather than use AWS root account credentials.

Question 42

Do users have to have an MFA device assigned to them in order to use MFA-protected API access?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 42

Yes, a user must first be assigned a unique hardware or virtual MFA device.

Question 43

Is MFA-protected API access compatible with S3 objects, SQS queues, and SNS topics?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 43

Yes.

Question 44

How does MFA-protected API access interact with existing MFA use cases such as S3 MFA Delete?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 44

MFA-protected API access and S3 MFA Delete do not interact with each other. S3 MFA Delete currently does not support temporary security credentials. Instead, calls to the S3 MFA Delete API must be made using long-term access keys.

Question 45

Does MFA-protected API access work in the GovCloud (US) region?

Multi-Factor Authentication

AWS Identity and Access Management (IAM) | Security, Identity & Compliance

Answer 45

Yes.