3 ms·
> (plus a backup MFA) IAM doesn't even let you register more than 1 MFA device.
by the8472 6y ago
> (plus a backup MFA)
IAM doesn't even let you register more than 1 MFA device.
- ak217 6y agoIf I were a CISO solving this problem today, I would just use TOTP instead of U2F, and store the secret in two places. Longer term I expect AWS will add this capability.
- ryan29 6y agoI have accounts for personal use and what I did was set up TOTP for the root account(s) and a U2F (YubiKey) device for the admin account(s). I use 2 YubiKeys; one primary, one spare. The YubiKey has limited TOTP space, but they're perfect for those types of high value accounts. You store the TOTP on both, so if you lose one you can use the root account to fix the admin account.
- sneak 6y agoAWS SSO does now, thankfully.