# Multi-factor authentication
<a name="multi-factor-authentication"></a>


| 
| 
| Essential Eight control | Implementation guidance | AWS resources | AWS Well-Architected guidance | 
| --- |--- |--- |--- |
| Multi-factor authentication is used by an organisation's users if they authenticate to their organisation's internet-facing services. | [Theme 4: Manage identities](theme-4.md): Implement identity federation | [Require human users to federate with an identity provider to access AWS by using temporary credentials](https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source.html)<br />[Implement temporary elevated access to your AWS environments](https://aws.amazon.com/blogs/security/managing-temporary-elevated-access-to-your-aws-environment/) | [SEC02-BP04 Rely on a centralized identity provider](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_identities_identity_provider.html) | 
| [Theme 4: Manage identities](theme-4.md): Enforce MFA | [Require MFA for the root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html)<br />[Require MFA through AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-configure-mfa-device-enforcement.html)<br />[Consider requiring MFA to service-specific API actions](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-mfa) | [SEC02-BP01 Use strong sign-in mechanisms](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_identities_enforce_mechanisms.html) | 
| Multi-factor authentication is used by an organisation's users if they authenticate to third-party internet-facing services that process, store or communicate their organisation's sensitive data. | See [Implementing Multi-Factor Authentication](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/implementing-multi-factor-authentication) (ACSC website) | Not applicable | Not applicable | 
| Multi-factor authentication (where available) is used by an organisation's users if they authenticate to third-party internet-facing services that process, store or communicate their organisation's non-sensitive data. | 
| Multi-factor authentication is enabled by default for non-organisational users (but users can choose to opt out) if they authenticate to an organisation's internet-facing services. | 
| Multi-factor authentication is used to authenticate privileged users of systems. | [Theme 4: Manage identities](theme-4.md): Implement identity federation | [Require human users to federate with an identity provider to access AWS by using temporary credentials](https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source.html)<br />[Implement temporary elevated access to your AWS environments](https://aws.amazon.com/blogs/security/managing-temporary-elevated-access-to-your-aws-environment/) | [SEC02-BP04 Rely on a centralized identity provider](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_identities_identity_provider.html) | 
| [Theme 4: Manage identities](theme-4.md): Enforce MFA | [Require MFA for the root user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa.html)<br />[Require MFA through IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-configure-mfa-device-enforcement.html)<br />[Consider requiring MFA to service-specific API actions](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-mfa) | [SEC02-BP01 Use strong sign-in mechanisms](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_identities_enforce_mechanisms.html) | 
| Multi-factor authentication is used to authenticate users accessing important data repositories. | [Theme 4: Manage identities](theme-4.md): Enforce MFA | [Consider requiring MFA to service-specific API actions](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_general.html#example-scp-mfa) | [SEC02-BP01 Use strong sign-in mechanisms](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_identities_enforce_mechanisms.html) | 
| Multi-factor authentication is verifier impersonation resistant and uses either: something users have and something users know, or something users have that is unlocked by something users know or are. | See [Implementing Multi-Factor Authentication](https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-hardening/implementing-multi-factor-authentication) (ACSC website) | Not applicable | Not applicable | 
| Successful and unsuccessful multi-factor authentications are centrally logged and protected from unauthorised modification and deletion, monitored for signs of compromise, and actioned when cyber security events are detected. | [Theme 7: Centralise logging and monitoring](theme-7.md): Enable logging<br />[Theme 7: Centralise logging and monitoring](theme-7.md): Centralise logs | [Centralise CloudWatch Logs in an account for auditing and analysis](https://aws.amazon.com/blogs/architecture/stream-amazon-cloudwatch-logs-to-a-centralized-account-for-audit-and-analysis/) (AWS blog post)<br />[Centralize management of Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/managing-multiple-accounts.html)<br />[Centralise management of Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/designate-orgs-admin-account.html)<br />[Create an organisation-wide aggregator in AWS Config](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html) (AWS blog post)<br />[Centralise management of GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html)<br />[Consider using Security Lake](https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html)<br />[Receive CloudTrail logs from multiple accounts](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html)<br />[Send logs to a log archive account](https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/security-ou-and-accounts.html#log-archive-account) | [SEC04-BP01 Configure service and application logging](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_app_service_logging.html)<br />[SEC04-BP02 Capture logs, findings, and metrics in standardized locations](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_detect_investigate_events_logs.html) |