19

I'm using multi-factor authentication (MFA) to log into the Amazon AWS console. I'm using Google Authenticator on my Android phone to generate the one-time tokens.

Other services sometimes provide one-time backup codes in case the token device is lost or damaged. Is there a way I can save some one-time backup codes for AWS MFA?

12

You can create redundant code before your device is lost or a reason.

Deactivate MFA, then configure and enable a virtual MFA device for use. Make a secure backup of the secret configuration key or QR code.

For example, if you lose the smartphone where the virtual MFA app is configured.

Google Authenticator → Set up account → Enter provided key

Account name: (root-account-mfa-device@xxxxxxxxxxx)
Enter your key: (secret configuration key)

6

As far as I can tell, there's no backup codes option, though I too would like to see one. This article describes your next best option:

All I had to do was go to the Unusable Authentication Device page and fill out just two fields of a simple form providing my Primary phone number I used to register my AWS account and then select the problem I encountered from the drop down. I selected “Other Problem Not listed here” since the most problems listed seemed to be specific to the Hardware MFA device.

He or she then notes that they were called, verified their account with them via info attached to it, then the device was removed. They also noted to make sure your phone number on your account is up to date so you can be called by them. I hope that helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.