AWS 2FA setup
AWS calls authenticator apps “virtual MFA devices” — it’s the same RFC 6238 TOTP underneath. A browser-based generator is a favourite for CI boxes, consoles-on-VMs, and situations where your phone isn’t the right tool. Root and IAM users each carry their own enrollment.
Fact-checked against AWS's official documentation · last reviewed 7 November 2026 · how we review guides
Open the generator for AWSStep by step
- 01
Open the IAM console
Sign in as an admin at console.aws.amazon.com → IAM → Users → pick the user → “Security credentials” tab. For the root user: IAM console home shows an “Add MFA” card for root — the enrollment lives there, not in a user profile.
- 02
Assign an MFA device
Click “Assign MFA device”, choose “Authenticator app” (the virtual-MFA option), and continue. AWS picks an arbitrary account name for display — it doesn’t affect anything.
- 03
Get the secret key
AWS shows a QR code. Click “Show secret key” below it and copy the Base32 string — that’s the secret you’d normally only scan.
- 04
Generate two consecutive codes
Paste the key into 2facounter.com. AWS asks for **two consecutive codes** — copy the current token, wait for the next 30-second step (watch the ring), then paste the fresh one.
- 05
Confirm activation
Enter both codes and click “Add MFA”. The device flips to “Active”. Test sign-in once immediately — if a code is rejected at sign-in, it’s usually clock drift, so check your device time sync.
- 06
Back up the key
The key is re-derivable only if you saved it: keep it encrypted in your password manager, because IAM won’t show it again after activation (deactivate and re-assign to rotate).
FAQ
What about the root account?
Root MFA is configured from the IAM console’s root card or Account settings page. Recent AWS guidance strongly prefers passkeys for root — set one if you can, but a TOTP device remains supported and works identically with this generator.
Why does AWS require two codes in a row?
To prove you truly control a synced authenticator rather than holding one leaked screenshot. Two codes from different time windows show the secret is live and your clock matches the server’s.
Can I enforce MFA on every IAM user with policy?
Yes — an IAM policy condition on aws:MultiFactorAuthPresent turns MFA from advice into policy for console sessions, and AWS’s Well-Architected guidance treats that baseline as a required control. Enrollment per user (this guide) is the prerequisite.
Can I use one MFA entry for multiple AWS accounts?
Each IAM user or root enrollment mints its own secret — never reuse keys across accounts. Generate a separate recent-key slot here for each enrollment; duplicate keys are an audit finding and a blast-radius problem.