Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) adds a second layer of protection beyond a password. In AWS, MFA requires presenting a one-time code from a registered device (virtual authenticator app, hardware token, or FIDO2 security key) in addition to the password when signing in to the console or performing sensitive API operations.

MFA Types in AWS

• Virtual MFA: TOTP apps like Google Authenticator, Authy (free, most common)
• Hardware TOTP token: physical key fob (e.g., Thales)
• FIDO2 security key: YubiKey, Titan (phishing-resistant, strongest)
• Passkeys: FIDO2-based passwordless authentication (supported since 2024)

Where to Require MFA

• Root account (mandatory per CIS benchmark)
• All IAM users with console access
• Sensitive API operations via IAM policy conditions (aws:MultiFactorAuthPresent)
• Cross-account role assumption