Skip to content

How can 2 people get MFA access

1

Is that possible that one account can have 2 MFA , like and my developer want access, i need such that he doesnot ask me for mFA each time he logins and same for me, how is that possible .Without any charge is that possible?

2 Answers
1

Yes, it is possible for multiple people to have MFA access to a single AWS account, and you can set this up without any additional charges. AWS allows you to register up to eight MFA devices of any combination of the supported types for each AWS account root user and IAM user. This means you and your developer can both have separate MFA devices associated with the same account.

Here's how you can set this up:

  1. Instead of sharing the root account (which is not recommended for security reasons), create separate IAM users for yourself and your developer with appropriate permissions.

  2. For each IAM user, you can enable multiple MFA devices. This could be a combination of virtual MFA devices (like Google Authenticator on smartphones), hardware tokens, or passkeys.

  3. You and your developer can each set up your own MFA device. This way, when either of you logs in, you'll use your own credentials and your own MFA device.

  4. If you're using a virtual MFA device like Google Authenticator, you can use the same QR code to set up the MFA on multiple devices. This allows both you and your developer to have the same MFA codes on your respective devices.

Remember, while it's possible to share MFA devices, it's generally more secure for each user to have their own unique MFA device. This approach provides better security and accountability, as each user has their own credentials and MFA device.

By setting up individual IAM users with their own MFA devices, you can avoid the need for sharing MFA codes, and each person can log in independently without needing to ask the other for the MFA code each time.
Sources
Multiplr root users for one MFA | AWS re:Post
Authenticator app vs Hardware Token | AWS re:Post
AWS Multi-factor authentication in IAM - AWS Identity and Access Management

answered 2 years ago

EXPERT

reviewed 2 years ago

1

You really shouldn't share credentials between users. It's technically possible to associate multiple MFA devices with a single user, but that's meant for supporting several MFA devices or applications for one person.

For you and the other person, you should create a separate IAM user for each person, and each of you should only register your own MFA device or several with your own IAM user.

IAM users, IAM user groups, IAM roles, IAM policies, and MFA authentication are completely free of charge in AWS IAM, so you don't need to worry about costs when using them in the proper and secure ways.

EXPERT

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.