Enabling a Hardware MFA Device (Console)
Topics
You can enable a hardware MFA device from the AWS Management Console, the command line, or the IAM API. The following procedure shows you how to use the AWS Management Console to enable the device for a user under your AWS account. To enable an MFA device for your AWS account root user, see Enable a Hardware MFA Device for the AWS Account Root User (Console).
You can enable one MFA device (of any kind) per root user or IAM user.
Note
If you want to enable the device from the command line, use
aws iam
enable-mfa-device. To enable the MFA device with the IAM API, use the EnableMFADevice
action.
Enable a Hardware MFA Device for an IAM User (Console)
You can enable a hardware MFA device from the AWS Management Console.
To enable a hardware MFA device for an IAM user (console)
-
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
-
In the navigation pane, choose Users.
-
Choose the name of the user for whom you want to enable MFA, and then choose the Security credentials tab.
-
Next to Assigned MFA device, choose the pencil icon (
).
-
In the Manage MFA Device wizard, choose A hardware MFA device and then choose Next Step.
-
Type the device serial number. The serial number is usually on the back of the device.
-
In the Authentication Code 1 box, type the six-digit number displayed by the MFA device. You might need to press the button on the front of the device to display the number.
-
Wait 30 seconds while the device refreshes the code, and then type the next six-digit number into the Authentication Code 2 box. You might need to press the button on the front of the device again to display the second number.
-
Choose Next Step.
Important
Submit your request immediately after generating the authentication codes. If you generate the codes and then wait too long to submit the request, the MFA device successfully associates with the user but the MFA device becomes out of sync. This happens because time-based one-time passwords (TOTP) expire after a short period of time. If this happens, you can resync the device.
The device is ready for use with AWS. For information about using MFA with the AWS Management Console, see Using MFA Devices With Your IAM Sign-in Page.
Enable a Hardware MFA Device for the AWS Account Root User (Console)
You can use IAM in the AWS Management Console to configure and enable a hardware MFA device for your root user. To manage MFA devices for the AWS account, you must be signed in to AWS using your AWS account root user credentials. You cannot manage MFA devices for the root user using other credentials.
If your MFA device is lost, stolen, or not working, you can still sign in using alternative factors of authentication. This means that if you can't sign in with your MFA device, you can sign in by verifying your identity using the email and phone that are registered with your account. Before you enable MFA for your root user, review your account settings and contact information to make sure that you have access to the email and phone number. To learn about signing in using alternative factors of authentication, see What If an MFA Device Is Lost or Stops Working?. To disable this feature, contact AWS Support.
Note
If you are using an AWS account created after September 14, 2017, you might see differences in the following console pages: Sign in with authentication device and Troubleshoot your authentication device. However, the same features are provided. In either case, if you cannot verify your account email address and phone number using alternative factors of authentication, contact AWS Support to deactivate your MFA setting.
To enable the MFA device for your root user (console)
-
Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
Important
To manage MFA devices for the AWS account, you must use your root user credentials to sign in to AWS. You cannot manage MFA devices for the root user while signed in with other credentials.
-
Do one of the following:
-
Option 1: Choose Dashboard, and under Security Status, expand Activate MFA on your root account.
-
Option 2: On the right side of the navigation bar, choose on your account name, and then choose Security Credentials. If necessary, choose Continue to Security Credentials. Then expand the Multi-Factor Authentication (MFA) section on the page.
-
-
Choose Manage MFA or Activate MFA, depending on which option you chose in the preceding step.
-
In the wizard, choose A hardware MFA device and then choose Next Step.
-
In the Serial Number box, type the serial number that is found on the back of the MFA device.
-
In the Authentication Code 1 box, type the six-digit number displayed by the MFA device. You might need to press the button on the front of the device to display the number.
-
Wait 30 seconds while the device refreshes the code, and then type the next six-digit number into the Authentication Code 2 box. You might need to press the button on the front of the device again to display the second number.
-
Choose Next Step. The MFA device is now associated with the AWS account.
Important
Submit your request immediately after generating the authentication codes. If you generate the codes and then wait too long to submit the request, the MFA device successfully associates with the user but the MFA device becomes out of sync. This happens because time-based one-time passwords (TOTP) expire after a short period of time. If this happens, you can resync the device.
The next time you use your root user credentials to sign in, you must type a code from the MFA device.
Replace or "Rotate" a Physical MFA Device
You can have only one MFA device assigned to a user at a time. If the user loses a device or needs to replace it for any reason, you must first deactivate the old device. Then you can add the new device for the user.
-
To deactivate the device currently associated with a user, see Deactivating MFA Devices.
-
To add a replacement hardware MFA device for an IAM user, follow the steps in the procedure Enable a Hardware MFA Device for an IAM User (Console) earlier in this topic.
-
To add a replacement virtual MFA device for the AWS account root user, follow the steps in the procedure Enable a Hardware MFA Device for the AWS Account Root User (Console) earlier in this topic.