MFA adds extra security by requiring users to enter a unique authentication code from their authentication device when accessing AWS websites or services.
For MFA to work, you must assign an MFA device (hardware or virtual) to the IAM user or root account. The MFA device must be unique for each user; a user cannot enter a code from another user's device to authenticate.
Virtual MFA device: A virtual MFA device uses a software application that generates six-digit authentication codes that are compatible with the Time-Based One-Time Password (TOTP) standard, as described in RFC 6238. The software application can run on mobile hardware devices, including Smartphone. Most virtual MFA applications allow you to host more than one virtual MFA device, which makes them more convenient than hardware MFA devices. However, you should be aware that because a virtual MFA might be run on a less secure device such as a Smartphone, a virtual MFA might not provide the same level of security as a hardware MFA device.
Use the MFA device when logging on or accessing AWS resources. For access to an AWS website, you need a user name, password, and MFA code (an OTP). For access to MFA-protected APIs, you need access keys, the device serial number (hardware) or ARN (virtual device), and an MFA code.
Virtual MFA Applications Applications for your smartphone can be installed only from the application store that is specific for your phone type. In the list below are names of some applications for different smartphone types.
To configure and enable a virtual MFA device for use with your root account
To configure and enable a virtual MFA device for a user
For MFA to work, you must assign an MFA device (hardware or virtual) to the IAM user or root account. The MFA device must be unique for each user; a user cannot enter a code from another user's device to authenticate.
Virtual MFA device: A virtual MFA device uses a software application that generates six-digit authentication codes that are compatible with the Time-Based One-Time Password (TOTP) standard, as described in RFC 6238. The software application can run on mobile hardware devices, including Smartphone. Most virtual MFA applications allow you to host more than one virtual MFA device, which makes them more convenient than hardware MFA devices. However, you should be aware that because a virtual MFA might be run on a less secure device such as a Smartphone, a virtual MFA might not provide the same level of security as a hardware MFA device.
Use the MFA device when logging on or accessing AWS resources. For access to an AWS website, you need a user name, password, and MFA code (an OTP). For access to MFA-protected APIs, you need access keys, the device serial number (hardware) or ARN (virtual device), and an MFA code.
Virtual MFA Applications Applications for your smartphone can be installed only from the application store that is specific for your phone type. In the list below are names of some applications for different smartphone types.
| Android | AWS Virtual MFA; Google Authenticator |
| iPhone | Google Authenticator |
| Windows Phone | Authenticator |
| Blackberry | Google Authenticator |
To configure and enable a virtual MFA device for use with your root account
- Use your root credentials to sign in to the AWS Management Console, and then go to the IAM console.
- On the IAM Dashboard, click Manage MFA Device. This starts the Manage MFA Device wizard.
- In the wizard, select A virtual MFA device and then click Continue.
- Confirm that a virtual MFA application is installed on the device, then click Continue. IAM generates and displays configuration information for the virtual MFA device, including a QR code similar to the following graphic.
- With the Manage MFA Device wizard still open, open the virtual MFA application on the device. The easiest way to configure the application is to use the application to scan the QR code. If you cannot scan the code, you can enter the configuration information manually.
- To use the QR code to configure the virtual MFA device, follow the app instructions for scanning the code. For example, you might need to tap the camera icon or tap a command like Scan account barcode, and then use the device's camera to scan the code.
- If you cannot scan the code, enter the configuration information manually by typing the Secret Configuration Key value into the application. For example, to do this in the AWS Virtual MFA application, tap Manually add account, and then type the secret configuration key and click Create.
Note:The QR code and secret configuration key are unique and cannot be reused.
When you are finished configuring the device, the device starts generating six-digit numbers.- Type the six-digit number that's currently displayed by the MFA device. Wait 30 seconds for the device to generate a new number, and then type the new six-digit number into the Authentication Code 2 box.
- Click Continue.
To configure and enable a virtual MFA device for a user
- Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
- In the navigation pane, click User and then select the user you want to enable the virtual MFA for.
- In the user details pane, select Security Credentials, and then click Manage MFA Device.
- In the Manage MFA Device wizard, select A virtual MFA device and then click Continue.
- Confirm that a virtual MFA application is installed on the user's mobile device and then click Continue. (For a list of apps that you can use as virtual MFA devices, see Multi-Factor Authentication.) IAM generates and displays configuration information for the virtual MFA device, including a QR code similar to the following graphic.
- With the Manage MFA Device wizard still open, open the virtual MFA application on the device. If the device supports QR codes, the easiest way to configure the application is to use the application to scan the QR code. If you cannot scan the code, you can enter the secret configuration key manually.
- To use the QR code to configure the virtual MFA device, follow the app instructions for scanning the code. For example, you might need to tap the camera icon or tap a command like Scan account barcode, and then use the device's camera to scan the code.
- If you cannot scan the code, enter the configuration information manually by typing the Secret Configuration Key value into the application. For example, to do this in the AWS Virtual MFA application, tap Manually add account, and then type the secret configuration key and click Create.
When you are finished configuring the device, the device starts generating six-digit numbers - In the IAM Manage MFA Device wizard, in the Authentication Code 1 box, type the six-digit number that's currently displayed by the MFA device. Wait 30 seconds for the device to generate a new number, and then type the new six-digit number into the Authentication Code 2 box.
- Click Continue.
