Can I generate backup codes for AWS multi-factor authentication (MFA)?

Question

I'm using multi-factor authentication (MFA) to log into the Amazon AWS console. I'm using Google Authenticator on my Android phone to generate the one-time tokens.

Other services sometimes provide one-time backup codes in case the token device is lost or damaged. Is there a way I can save some one-time backup codes for AWS MFA?

Answer 1

You can create redundant code before your device is lost or a reason.

Deactivate MFA, then configure and enable a virtual MFA device for use. Make a secure backup of the secret configuration key or QR code.

For example, if you lose the smartphone where the virtual MFA app is configured.

Google Authenticator → Set up account → Enter provided key

Account name: (root-account-mfa-device@xxxxxxxxxxx)
Enter your key: (secret configuration key)

Answer 2

As far as I can tell, there's no backup codes option, though I too would like to see one. This article describes your next best option:

All I had to do was go to the Unusable Authentication Device page and fill out just two fields of a simple form providing my Primary phone number I used to register my AWS account and then select the problem I encountered from the drop down. I selected “Other Problem Not listed here” since the most problems listed seemed to be specific to the Hardware MFA device.

He or she then notes that they were called, verified their account with them via info attached to it, then the device was removed. They also noted to make sure your phone number on your account is up to date so you can be called by them. I hope that helps.

Answer 3

This info is provided if you lose the MFA device:

If your AWS account root user multi-factor authentication (MFA) device is lost, damaged, or not working, you can sign in using alternative methods of authentication. This means that if you can't sign in with your MFA device, you can sign in by verifying your identity using the email and phone number registered with your account.