- Newest
- Most votes
- Most comments
Hello.
MFA devices cannot be shared across accounts or users.
You cannot share the same device and set up MFA.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_physical.html
MFA devices cannot be shared across accounts or users.
So, how about assigning the device to the root user of the Organizations management AWS account and restricting it with SCP so that the root user cannot operate it in the member AWS account?
https://docs.aws.amazon.com/organizations/latest/userguide/best-practices_member-acct.html#bp_member-acct_use-scp
Alternatively, I think it would be a good idea to set up virtual MFA for the root user of the member AWS account.
https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-virt-mfa-for-root.html
Yes, you can use the same app-based OTP or hardware backed security key for more than one root user.
In deciding to do so, you're increasing the blast radius of that one particular authenticator, so just think of it as striking a balance between blast radius and sheer number of authenticators. Using the same set of authenticators for everything likely isn't wise, but a different set for every account likely isn't either, find the balance that's right for you. Regardless of where you draw those lines, be sure to use 2+ (as you've mentioned) to eliminate the singular dependency on one authenticator.
Relevant content
- asked 2 months ago
AWS OFFICIALUpdated 3 years ago
Thank you. I'd somehow missed that snippet when reading that docs page.
Will setup the SCPs blocking root access for the member accounts and also add virtual MFA to the root users of the member accounts (if I can do both without too much difficulty then seems good to have the MFA there is anyone does later decide we've got a good reason to allow root access for the member accounts).
For the hardware device to use on the root user on the management account - it seems we could use either Yubikey or a TOTP device. Is one preferred over the other? Would either one satisfy the security hub control that brings this to attention https://docs.aws.amazon.com/config/latest/developerguide/root-account-hardware-mfa-enabled.html? (if only one satisfies the control then would prefer to go with the one that satisfies it, rather than setting up the other and suppressing the findings from this control).
The restriction referred to here is only applicable to the older style hardware OTP devices, it does not apply to app-based TOTP (as asked) or hardware security keys.