Multi-Factor Authentication in AWS: A Practical Guide

What Is Multi-Factor Authentication (MFA)? 

Multi-factor authentication (MFA) is a security mechanism that requires an individual to provide two or more pieces of evidence (or factors) to confirm their identity before gaining access to a system or data. These factors usually fall into one of three categories: something you know (like a password), something you have (like a physical token or access card), and something you are (like a fingerprint or retinal pattern).

In AWS, MFA protects two groups of people: the team members who sign in to your AWS accounts, and the end users of the applications you build on AWS. This guide covers the MFA options in IAM and IAM Identity Center, how to set them up, and where Amazon Cognito fits for application users.

Which AWS Identity Services Support MFA? 

MFA in AWS covers two groups of people. Your own team signs in to AWS accounts as the root user, as IAM users or through IAM Identity Center. The end users of an application you build sign in through Amazon Cognito. Each service has its own MFA settings.

AWS Identity and Access Management (IAM)

IAM controls access to AWS resources and services. You can turn on MFA for the root user of every AWS account and for each IAM user, and AWS enforces MFA for the root user on all account types. A root user or IAM user can register up to eight MFA devices of any type and needs only one of them to sign in.

IAM supports three types of MFA device:

Passkeys and security keys

These FIDO-based authenticators use public key cryptography and resist phishing, man-in-the-middle and replay attacks. AWS supports physical security keys, such as a YubiKey, and synced passkeys stored in a credential manager from Apple, Google, Microsoft or a third-party password manager. AWS recommends them over the other options. You can enable them only in the AWS Management Console, not through the AWS CLI or API.

Virtual authenticator apps

An app on a phone or other device generates a six-digit time-based one-time password (TOTP) that the user types at sign-in. AWS accepts apps that follow the TOTP standard (RFC 6238) and suggests them as an interim option until users have passkeys or security keys.

Hardware TOTP tokens

A small physical device generates a six-digit TOTP code. IAM accepts only tokens whose seeds were shared securely with AWS, so they must be bought through the sources AWS links to; other tokens won't work.

AWS no longer lets you enable SMS text-message MFA for IAM users. Users who still have it should move to one of the three types above.

AWS IAM Identity Center

IAM Identity Center gives your workforce single sign-on to multiple AWS accounts and applications. Its users, credentials and MFA settings are separate from IAM users. If you connect an external identity provider, that provider manages MFA instead.

Amazon Cognito

Amazon Cognito adds sign-up, sign-in and access control to the applications you build. Its user pools have their own MFA settings for your application's users, covered below.

Related content: Read our guide to multi factor authentication types

Setting Up MFA for an IAM User

To assign an authenticator app to an IAM user in the AWS Management Console:

1. Open the IAM console and choose Users in the navigation pane.
2. Choose the name of the IAM user.
3. Open the Security credentials tab. Under Multi-factor authentication (MFA), choose Assign MFA device.
4. Enter a device name, choose Authenticator app and choose Next.
5. Scan the QR code with the authenticator app, or type the secret key into it.
6. Enter two consecutive codes from the app and choose Add MFA. Submit them right away: codes that wait too long leave the device out of sync.

To register a passkey or security key instead, choose that option in the same wizard. To let users register their own devices, grant them the permissions in the AWS example policy that allows MFA-authenticated IAM users to manage their own MFA device.

Setting Up MFA in IAM Identity Center

These steps apply to users in the IAM Identity Center directory, not to IAM users:

1. Open the IAM Identity Center console and choose Settings.
2. On the Authentication tab, find Multi-factor authentication and choose Configure.
3. Under Prompt users for MFA, choose Every time they sign in (the default and most secure), Only when their sign-in context changes, which prompts again when the device, browser or location changes, or Never, which AWS doesn't recommend.
4. Choose Save changes.

MFA for Applications Built on Amazon Cognito

For the end users of your own application, MFA is a user pool setting. You can turn it off, make it optional or require it, and choose which second factors users can set up: SMS messages, email messages or a TOTP authenticator app. SMS needs an IAM role for Amazon SNS, and email needs your own Amazon SES configuration plus the Essentials or Plus feature plan. Users who sign in through a federated identity provider complete MFA with that provider, not with Cognito.

Our AWS Cognito MFA guide covers each method, a step-by-step setup and the limitations to plan for.

Frontegg: The Ultimate Amazon Cognito Alternative

The industry standard today involves the use of authentication providers to “build the door”, but what about authorization (the door knob)? Most authentication vendors don’t go that extra mile, forcing SaaS vendors to invest in expensive in-house user management development. This often leads to delays in core technology development, which negatively impacts innovation and time-to-market (TTM) metrics. 

Frontegg’s end-to-end user management platform allows you to authenticate and authorize users with just a few clicks. Integration takes just a few minutes and a few lines of code, thanks to its plug-and-play nature. It’s also multi-tenant by design and self-served by nature, something that helps reduce friction and improves user satisfaction. Also, all user roles and permissions can be managed via a centralized dashboard. It’s really that easy.

START FOR FREE