Configuring MFA
Each cloud provider has its own mechanism to enforce the use of MFA to protect authentication attempts against potential account breaches.
Best practices for configuring MFA using AWS IAM
The following is a list of best practices:
- Enable MFA on the AWS account root user.
- Enable MFA on any IAM user with high privileges to the AWS console (such as an admin role).
- Enable MFA for AWS console access and so that users must authenticate themselves using MFA before programmatically calling for API access requests.
- For non-sensitive environments, use a virtual MFA device (such as Google Authenticator) for better protection of your IAM users' access.
- For sensitive environments, use a hardware MFA device or U2F security key (such as Yubikey).
- Avoid using SMS as part of MFA (due to vulnerabilities in the SMS protocol).
For more information, please refer to the following resources:
Using multi-factor authentication (MFA) in AWS:
...
