3 ms·
Hum... I'm the processo to add Yubikey or any U2F to my AWS account, can you share any advice, feedback? Risks, etc?
by rafaelturk 6y ago
Hum... I'm the processo to add Yubikey or any U2F to my AWS account, can you share any advice, feedback? Risks, etc?
- michaelt 6y agoAWS is crap in this regard, because you can only have a single 2FA device registered for your root account. That means if you lose that 2FA device, you're hosed. Unless you can convince support to turn off your account's 2FA which one would hope they wouldn't do under any circumstances. Instead, you should use TOTP with a mobile app. That way you can make a backup by enrolling several phones with the same QR code - or printing out the QR code and storing it somewhere safe.
- viraptor 6y agoAlternatively don't use u2f on your root account, just on a standard user. And never touch the root account for anything other than provisioning users.
- andrewnicolalde 6y agoOr use two security keys, one on your root user and another for your own personal IAM user, but you're right, don't use your root user for everyday tasks.