AWS Certified Cloud Practitioner / Identity and Access Management

IAM MFA Hands On

🔐 AWS IAM Security Configuration

When someone logs into AWS, their browser sends credentials over the internet, AWS checks them, and grants access if they're valid. Weak or stolen credentials mean an attacker can log in from anywhere.

That is why AWS provides two essential defense mechanisms:

  1. Strong Password Policy

  2. Multi-Factor Authentication (MFA)

Let’s implement both — step by step.

🔑 Step 1: Set a Password Policy

In the console: IAM → Account settings → find the password policy → Edit

You can start from AWS's default policy or build your own.

  • Minimum password length

  • Uppercase letters

  • Lowercase letters

  • Numbers

  • Symbols (@ # $ %)

  • Force passwords to expire on a schedule (e.g. every 90 days)

  • Require an admin reset once expired, or let users reset their own

  • Block reuse of the current password — or any past password — so rotation can't just cycle through the same few

That covers layer one.

🔐 Step 2: Enable MFA on the Root Account

The root account has unrestricted access — if it's compromised, someone can delete resources, change billing, remove users, or take down production. That's why MFA on root matters more than anywhere else.

To enable it (as root): click your account name (top right) → Security credentials → Multi-Factor Authentication → Assign MFA device.

MFA options:

Virtual MFA (recommended) — an app like Google Authenticator, Authy, or Twilio Authenticator.


Setup — choose "Authenticator App" → scan the QR code AWS shows you → the app generates a 6-digit code that refreshes every 30 seconds → enter two codes in a row → done. One app can hold codes for multiple accounts.

  1. U2F security key — a physical USB/NFC device like a YubiKey. Plug it in or tap it at login. One key can serve multiple IAM users.

  2. Hardware TOTP token — a small physical device that generates codes without needing a phone. Common in strict corporate environments.

⚠️ One warning: if you lose your MFA device, you can get locked out, and recovery isn't simple. Keep a backup device, store it safely, and consider registering more than one.