How do I troubleshoot IAM authentication failures and AWS Management Console access issues?

Resolution

IAM authentication failures and AWS Management Console access issues can occur for several reasons. Use the following sections to troubleshoot your issue.

Resolve sign-in and credential issues

If you can't sign in to the AWS Management Console or forgot your credentials, then see the following AWS Knowledge Center articles:

• What do I do if I can't sign in to my AWS account?
• How do I sign in to my AWS account if my credentials don't work?

To further troubleshoot sign-in issues, password resets, and credential issues, see Troubleshooting AWS account sign-in issues.

Verify your sign in method

Account root users, IAM users, and federated users each have different authentication methods. Confirm that you're using the correct sign-in method for your user type.

To sign in as your user type, see the following AWS Documentation:

• To sign in as the root user
• To sign in as an IAM user
• Sign in as a federated identity

Check password and credential requirements

For information about password management and credential issues, see Manage passwords for IAM users.

Check browser and network settings

If you continue to experience sign-in issues, then clear your browser cache and cookies or try a different browser. Also, verify that your network connection allows access to AWS sign-in domains.

Troubleshoot federated authentication

For federated authentication issues, see Troubleshoot SAML federation with IAM.

Troubleshoot MFA device issues

To troubleshoot multi-factor authentication (MFA) issues, see AWS multi-factor authentication in IAM and check the MFA status.

Resolve time synchronization issues

Virtual MFA devices and hardware time-based, one-time passwords (TOTP) tokens require accurate time synchronization. If authentication codes repeatedly fail, then resynchronize your virtual and hardware MFA devices.

Recover lost or broken MFA devices

If you're an account root user, then see My MFA device is lost or stopped working. If you're an IAM user, then contact your administrator to deactivate the lost device. 

Use CloudTrail to troubleshoot authentication failures

AWS CloudTrail logs all AWS Management Console sign-in events. To identify authentication failure patterns, review the CloudTrail logs. 

Complete the following steps:

1. Open the CloudTrail console.
2. In the navigation pane, choose Event history.
3. For Lookup attributes, choose Event name.
4. In the search field, enter ConsoleLogin.
5. Select a ConsoleLogin event, and then check the following fields:
   To identify who signed in, view User name.
   To identify the failure, view Error code.
   To identify the sign-in location, view Source IP address.

Implement security best practices

After you resolve authentication issues, implement security best practices in IAM to protect your account.