4 ms·
So, what i never understood about this flow is that only admins can set up mfa. A non admin (any account without IAM permissions) has no way to set up mfa unle
by nhumrich 8y ago
So, what i never understood about this flow is that only admins can set up mfa. A non admin (any account without IAM permissions) has no way to set up mfa unless an admin does it for them. Currently, I have to have the person tell me their mfa codes next to me, so I van type them in and set it up. How does this work for U2F? Do I have to use their usb device on my computer to allow them to have MFA?
It's such a chicken and egg problem.
- bdcravens 8y agoAbility to set one's MFA is something you'd set in IAM, as opposed to a truly permissionless account. https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-mfa-and-creds.html https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_us...
- akerl_ 8y agoYou can give IAM users permission to add their own MFA device. I’d recommend requiring MFA to remove the device to prevent an attacker from doing so