3 ms·
> AWS Identity and Access Management (IAM) now supports multiple multi-factor authentication (MFA) devices for root account users and IAM users in your AWS acco
by chromatin 4y ago
> AWS Identity and Access Management (IAM) now supports multiple multi-factor authentication (MFA) devices for root account users and IAM users in your AWS accounts. This provides additional flexibility and resiliency in your security strategy by enabling more than one authentication device per user. You can choose from one or more types of hardware and virtual devices supported by IAM.
*YES!!!*
- bob-bot 4y agoMy last company we used only virtual MFA as it was easier to manage with a remote team. For Root MFA, could easily enforce a 2 group action through a password manager, one group to obtain the password, the other to get the TOTP. Before having the ability to apply both HW and Virtual tokens per user, what did you do? only use HW devices? Or just Virtual? What use cases do you have now for both at the same time?
- chromatin 4y agoI am currently using only virtual. With IAM supporting only a single MFA per account, it created a huge risk to involve a HW token that could be lost. I am transitioning many of my accounts (not just AWS) to hardware tokens and away from TOTP, but it is important to have > 1 token enrolled in case of loss.
- bob-bot 4y agoYea good point, nice to have backup just incase. Thanks for sharing