- OK, so now let's run through another Demo,
Managing an MFA Device for our users.
So again, I'm logged into the console.
I'm here at the Identity and Access Management Dashboard,
and what I want to do in this example is to add
an MFA device, Multifactor Authentication,
for a particular user.
In this case we're going to use the Jane Doe user
that we've created.
So I'm going to click through to that user's details.
I'm gonna scroll down, make sure that I'm on the
Security Credentials tab.
I'm going to scroll down.
And you can see that Jane Doe does not yet have
a Multifactor Authentication device listed.
So you can see here that we have two options.
We can use a virtual MFA device that's for an
application on a smartphone, or we can use
a hardware MFA device.
Now, in order to use the hardware MFA device, and again
the hardware option is recommended for your root account,
and you would have to order that hardware MFA device
directly from Amazon.
In this example we're going to use a virtual MFA device
that would be there are a number of different applications
available for smartphones such as Authy or
Google Authenticator, just to name a couple.
So, I'm going to click that, hit Next.
Yes, I understand that it is for a smartphone.
I'm gonna click Next.
And you can see from here,
it gives us this particular QR code that we would use
the application on our phone to scan this,
and then that application will automatically configure
that MFA code.
I could, alternately, for some other applications that
don't have the ability to scan that QR code,
I could show the Secret Key, and then just copy and paste
that and put it into the application.
And then of course, in order to be able to use this device,
what we would do is we would implement the
authentication code twice,
and from there once we have those codes,
we could then activate that virtual MFA.
OK, so from here I'm going to use the application
on my smartphone to scan this particular QR code.
And then once I've got that done,
I want to take the
codes from that device.
I'm going to add the first code here.
And then wait.
It's gonna take a few seconds up to 30 seconds.
Every 30 seconds the code rotates to another one.
So in order to activate this MFA device, we need to
put in two consecutive codes so that it ensures that we
actually have it configured correctly.
So the next code that comes up would be this one here.
Two codes, and it ensures that both of them were correct,
and now I have the Multifactor Authentication
configured correctly.
So now, and of course I would have done that on
Jane's phone, in some organizations sometimes,
if it's a small team, I might just have Jane come over
to my desk and have her use her phone to scan that
QR code and set up the MFA.
In larger organizations, that's perhaps not feasible
especially if you are dealing with people that are remote,
and so in those situations you want to give those users
permission to manage their own MFA device.
Now it's important to, in some cases, deactivate
an MFA device.
Let's say that Jane lost her phone.
That's a really good time to come in and deactivate that
so that whoever picks up her phone can't go and start
using her MFA device.
So in that case, we want to be sure to click that
and deactivate.
It's pretty rare for virtual MFA devices to have to be
resynchronized, but for physical key fobs sometimes
you have to do that.
But in this case, considering that Jane may have
lost her phone, I want to deactivate that.
I'm gonna choose Deactivate, click Next,
and now the MFA device is gone.
So that's how we manage an MFA device for a user
within Amazon Web Services Identity and Access Management.