Description:
Multi-Factor Authentication (MFA) adds an extra layer of authentication assurance beyond traditional credentials. With MFA enabled, when a user signs in to the AWS Console, they will be prompted for their user name and password as well as for an authentication code from their physical or virtual MFA token. It is recommended that MFA be enabled for all accounts that have a console password.
Rationale:
Enabling MFA provides increased security for console access as it requires the authenticating principal to possess a device that displays a time-sensitive key and have knowledge of a credential.
Perform the following to enable MFA:
From Console:
IAM generates and displays configuration information for the virtual MFA device, including a QR code graphic. The graphic is a representation of the 'secret configuration key' that is available for manual entry on devices that do not support QR codes.
When you are finished, the virtual MFA device starts generating one-time passwords.
In the 'Manage MFA Device wizard', in the 'MFA Code 1 box', type the 'one-time password' that currently appears in the virtual MFA device. Wait up to 30 seconds for the device to generate a new one-time password. Then type the second 'one-time password' into the 'MFA Code 2 box'.
Click 'Assign MFA'.