User Without MFA
- Solomon F Prophete
Analytics
Multi-factor authentication is the process of securing an account password with the added step of verification through a mobile device. With this process enabled, the risk of an attacker gaining illicit access to the account is significantly reduced because of the need to know the password as well as obtain a person’s mobile device. The steps to enable this taken straight from AWS documentation are as follows:
You can use IAM in the AWS Management Console to enable and manage a virtual MFA device for an IAM user in your account. To enable and manage an MFA device using the AWS CLI or AWS API, see Enabling and Managing Virtual MFA Devices (AWS CLI or AWS API).
Note
You must have physical access to the hardware that will host the user's virtual MFA device in order to configure MFA. For example, you might configure MFA for a user who will use a virtual MFA device running on a smartphone. In that case, you must have the smartphone available in order to finish the wizard. Because of this, you might want to let users configure and manage their own virtual MFA devices. In that case, you must grant users the permissions to perform the necessary IAM actions. For more information and for an example of an IAM policy that grants these permissions, see AWS: Allows MFA-Authenticated IAM Users to Manage Their Own MFA Device on the My Security Credentials Page.
To enable a virtual MFA device for an IAM user (console)
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
In the navigation pane, choose Users.
In the User Name list, choose the name of the intended MFA user.
Choose the Security credentials tab. Next to Assigned MFA device, choose Manage.
In the Manage MFA Device wizard, choose Virtual MFA device, and then choose Continue.
IAM generates and displays configuration information for the virtual MFA device, including a QR code graphic. The graphic is a representation of the "secret configuration key" that is available for manual entry on devices that do not support QR codes.
Open your virtual MFA app. (For a list of apps that you can use for hosting virtual MFA devices, see Multi-Factor Authentication.) If the virtual MFA app supports multiple accounts (multiple virtual MFA devices), choose the option to create a new account (a new virtual MFA device).
Determine whether the MFA app supports QR codes, and then do one of the following:
From the wizard, choose Show QR code, and then use the app to scan the QR code. For example, you might choose the camera icon or choose an option similar to Scan code, and then use the device's camera to scan the code.
In the Manage MFA Device wizard, choose Show secret key, and then type the secret key into your MFA app.
When you are finished, the virtual MFA device starts generating one-time passwords.
In the Manage MFA Device wizard, in the MFA code 1 box, type the one-time password that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second one-time password into the MFA code 2 box. Choose Assign MFA.
Important
Submit your request immediately after generating the codes. If you generate the codes and then wait too long to submit the request, the MFA device successfully associates with the user but the MFA device is out of sync. This happens because time-based one-time passwords (TOTP) expire after a short period of time. If this happens, you can resync the device.
The virtual MFA device is now ready for use with AWS. For information about using MFA with the AWS Management Console, see Using MFA Devices With Your IAM Sign-in Page.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html