No MFA device is assigned, still being requested to enter MFA Code

Question

Hi,

one of our IAM users, started getting MFA Code entry screens on login, although no MFA device is configured in IAM/users/Security Credentials/Assigned MFA device.

What else do I need to check?

Answer

Is your account part of a cross acount setup or organisation. Could be configured for the [aws account](https://aws.amazon.com/blogs/security/how-do-i-protect-cross-account-access-using-mfa-2/)?

Answer

Hi rePost-User-1949278,

I remember I had a similar issue a while ago. It was like a "ghost" MFA configuration. I recommend installing the AWS Cli ([step-by-step in case you need it](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html)) and "digging" the user information from the CLI. Here are some commands that might help:

`aws iam list-mfa-devices --user-name $YOUR_USER`

If the command above retrieves any information like the following structure:

```
{  
    "MFADevices": [
        {
            "UserName": "YOUR_USER",
             "SerialNumber": "arn:aws:iam::$account-number:mfa/YOUR_USER",
              "EnableDate": "YYYY-MM-DDTHH:MIMSS"
        }
    ]
}
```
You may delete the MFA bind to the the account with the `aws iam delete-virtual-mfa-device --serial-number $VIRTUAL_DEVICE_ARN` command.

I hope this helps.

Best regards, Gabriel Bartholomeu

No MFA device is assigned, still being requested to enter MFA Code

Relevanter Inhalt