Introduction

Multi-Factor Authentication (MFA) is a security mechanism that requires users to provide two or more verification factors to gain access to resources such as AWS services. When using AWS Command Line Interface (CLI), integrating MFA enhances security by adding an additional verification step beyond just using your Access Key ID and Secret Access Key.

Why Use MFA with AWS CLI

1. Increased Security: MFA significantly reduces the risk of unauthorized access if your AWS credentials are compromised.
2. Compliance: Many security standards and compliance frameworks recommend or require MFA for access to sensitive systems.
3. Prevent Credential Misuse: Limits the impact of credential leakage, even if the credentials are exposed.

Understanding MFA in AWS

With AWS, MFA involves the following components:

• MFA Device: Either a virtual MFA app on a smartphone or a hardware MFA device.
• MFA Token: A time-based one-time password (TOTP) generated by the MFA device.

Prerequisites

Before configuring MFA, ensure:

• You have AWS CLI installed on your system.
• You have access to an AWS account with appropriate permissions.
• You have configured a virtual MFA device or hardware MFA device.

Configuring MFA for AWS CLI

Below is a step-by-step guide to set up and use MFA with AWS CLI.

Step 1: Enable MFA for IAM Users

1. Navigate to the IAM console.
2. Select "Users" from the navigation pane and choose your username.
3. Under "Security credentials", click on "Manage" next to "Assigned MFA device".
4. Follow the instructions to assign a virtual MFA device (such as Google Authenticator or Authy) or a hardware MFA device.

Step 2: Retrieve MFA Serial Number

After enabling MFA, note the serial number for the MFA device, usually in the format `arn:aws:iam::account-id:mfa/user`.

Step 3: Configure CLI Profile

To interact with AWS services using the CLI, create a named profile in `~/.aws/credentials`:

• Do Not Store Permanent Access Keys: Avoid storing AWS access keys in code repositories or environments that do not require them.
• Regularly Rotate MFA Device: Ensure your MFA device is up-to-date and functional.
• Automate Session Retrieval: Consider scripting the session token retrieval and profile configuration to streamline the process.