4 ms·

Key note: U2F isn't currently supported in the API, CLI or mobile apps. Docs are unclear as to what the fallback 2FA is, if there is one. Also, as before, you c

Key note: U2F isn't currently supported in the API, CLI or mobile apps. Docs are unclear as to what the fallback 2FA is, if there is one. Also, as before, you can only have one 2FA method configured at a time, so say goodbye to your hardware tokens or TOTP configurations for AWS if you switch to U2F. EDIT: "Fallback" is to have root account remove your IAM user 2FA. If root account 2FA is lost they have a few alternative verification options like email or phone call. [1] 1: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_lost-or-broken.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...

jchw 8y ago
I find this annoying. I'd like to use U2F for my AWS accounts, but it seems like the drawbacks are pretty hard to deal with. With TOTP, you could still use API keys to interact with the API. Is that also true of U2F?
ummonk 8y ago
Uggh. That makes it useless if you require mfa for command-line access (using assume-role).
technion 8y ago
As annoying as that is, if I can run U2F on the root account and the few console accounts I have, I'll feel like we've covered thing most likely to be phished. People are unlikely to type API keys into a phishing site.
Alex3917 8y ago
> Also, as before, you can only have one 2FA method configured at a time, so say goodbye to your hardware tokens or TOTP configurations for AWS if you switch to U2F AWS makes it super quick and easy to remove lost 2FA devices using the root account, so it doesn't really matter as much as losing your 2FA for a crypto exchange or whatever where it's going to take at least a week or two to reset. Just keep TOTP on the root account, since you shouldn't be logging into that on a regular basis anyway.
illumin8 8y ago
I use this nice open source tool (really just some shell scripts) that Coinbase created, which supports cross-account assume-role with MFA at the command line: https://github.com/coinbase/assume-role https://github.com/coinbase/assume-role edit: and apparently it doesn't work with this... :'(

jchw 8y ago

I find this annoying. I'd like to use U2F for my AWS accounts, but it seems like the drawbacks are pretty hard to deal with. With TOTP, you could still use API keys to interact with the API. Is that also true of U2F?

ummonk 8y ago

Uggh. That makes it useless if you require mfa for command-line access (using assume-role).

technion 8y ago

As annoying as that is, if I can run U2F on the root account and the few console accounts I have, I'll feel like we've covered thing most likely to be phished. People are unlikely to type API keys into a phishing site.

Alex3917 8y ago

> Also, as before, you can only have one 2FA method configured at a time, so say goodbye to your hardware tokens or TOTP configurations for AWS if you switch to U2F AWS makes it super quick and easy to remove lost 2FA devices using the root account, so it doesn't really matter as much as losing your 2FA for a crypto exchange or whatever where it's going to take at least a week or two to reset. Just keep TOTP on the root account, since you shouldn't be logging into that on a regular basis anyway.

illumin8 8y ago

I use this nice open source tool (really just some shell scripts) that Coinbase created, which supports cross-account assume-role with MFA at the command line: https://github.com/coinbase/assume-role https://github.com/coinbase/assume-role edit: and apparently it doesn't work with this... :'(