Skip to content
GoHackersCloud Academy

Lesson 09 — Multi-Factor Authentication (MFA)

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

🎯 Lesson Objective

Section titled “🎯 Lesson Objective”

By the end of this lesson, you will be able to:

  • Explain what Multi-Factor Authentication (MFA) is.
  • Understand why MFA is critical for cloud security.
  • Configure MFA for the AWS Root User.
  • Configure MFA for IAM Users.
  • Understand different MFA device types.
  • Apply enterprise MFA best practices.
  • Troubleshoot common MFA issues.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Beginner

Prerequisites: Lesson 08 – Least Privilege & Permission Boundaries

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

Section titled “💼 Business Value”

Passwords are no longer enough.

Every day attackers use:

  • Password guessing
  • Credential stuffing
  • Phishing
  • Password leaks
  • Brute-force attacks

If an attacker steals an employee’s password, they may gain complete access to cloud resources.

Multi-Factor Authentication (MFA) provides an additional layer of security by requiring another form of verification before access is granted.

For enterprise organisations, MFA is one of the simplest and most effective security controls.

🏢 In the Company

Section titled “🏢 In the Company”

CloudNova Technologies has recently experienced multiple phishing emails targeting employees.

One developer unknowingly entered their AWS password into a fake login page.

Fortunately, the account had MFA enabled.

Although the attacker knew the password, they could not log in because they did not have the second authentication factor.

The incident was contained without any impact to the business.

Following this incident, the CISO announced:

“MFA will be mandatory for every privileged account in our AWS environment.”

🌍 What is Multi-Factor Authentication?

Section titled “🌍 What is Multi-Factor Authentication?”

Multi-Factor Authentication (MFA) requires users to verify their identity using two or more authentication factors.

Instead of relying only on a password, users must also provide an additional verification factor.

Authentication becomes significantly more secure because attackers must compromise multiple factors.

🔑 Authentication Factors

Section titled “🔑 Authentication Factors”

Authentication generally falls into three categories.

Something You Know

Section titled “Something You Know”
  • Password
  • PIN
  • Passphrase

Something You Have

Section titled “Something You Have”
  • Mobile Authenticator App
  • Hardware Security Key
  • MFA Token
  • Smart Card

Something You Are

Section titled “Something You Are”
  • Fingerprint
  • Face Recognition
  • Iris Scan

AWS MFA commonly uses:

  • Something You Know (Password)
  • Something You Have (Authenticator Device)

🔒 How MFA Works

Section titled “🔒 How MFA Works”
User


      │


Username


      │


Password


      │


MFA Code


      │


Authentication Successful


      │


AWS Console

Even if the password is stolen, the attacker still requires the MFA code.

🛡 Why MFA Matters

Section titled “🛡 Why MFA Matters”

Without MFA

Password Stolen


↓


Attacker Logs In


↓


AWS Environment Compromised

With MFA

Password Stolen


↓


MFA Required


↓


Attacker Blocked


↓


Environment Protected

🏗 MFA Device Types

Section titled “🏗 MFA Device Types”

AWS supports several MFA device options.

Device Description
Virtual MFA Mobile authenticator applications
Hardware MFA Physical security devices
FIDO2 Security Key USB or NFC hardware security keys
Passkeys Supported authentication methods for compatible devices

Virtual MFA devices are the most common choice for personal learning environments.

📱 Popular Authenticator Applications

Section titled “📱 Popular Authenticator Applications”

Examples include:

  • Google Authenticator
  • Microsoft Authenticator
  • Authy
  • 1Password
  • Bitwarden Authenticator

Each generates a new six-digit code every 30 seconds.

🔐 Root User MFA

Section titled “🔐 Root User MFA”

The AWS Root User has unrestricted access to the AWS account.

For this reason:

  • MFA must always be enabled.
  • Root credentials should rarely be used.
  • Root access should be securely stored.
  • Root login should be monitored.

The Root User should only be used for tasks that require root privileges.

👤 IAM User MFA

Section titled “👤 IAM User MFA”

Privileged IAM Users should also use MFA.

Examples include:

  • Cloud Administrators
  • Security Engineers
  • Cloud Engineers
  • DevOps Engineers

Read-only users may also use MFA depending on organisational policy.

🏢 CloudNova MFA Policy

Section titled “🏢 CloudNova MFA Policy”

CloudNova defines the following MFA requirements.

User Type MFA Required
Root User Yes
Cloud Administrators Yes
Security Team Yes
Cloud Engineers Yes
Developers Yes
Finance Yes
Auditors Yes
Service Roles No
Lambda Roles No
EC2 Roles No

IAM Roles do not require MFA because they use temporary credentials instead of passwords.

🚫 Common Mistakes

Section titled “🚫 Common Mistakes”

Avoid the following:

❌ Sharing MFA devices.

❌ Disabling MFA for convenience.

❌ Using the Root User daily.

❌ Storing MFA recovery codes insecurely.

❌ Ignoring lost devices.

✅ Enterprise Best Practices

Section titled “✅ Enterprise Best Practices”
  • Enable MFA immediately after creating users.
  • Require MFA for all privileged accounts.
  • Protect the Root User with MFA.
  • Use IAM Roles instead of shared accounts.
  • Monitor failed login attempts.
  • Review MFA status regularly.
  • Replace lost MFA devices immediately.

🧪 Enterprise Mission 01 — Review MFA Status

Section titled “🧪 Enterprise Mission 01 — Review MFA Status”

Open the AWS Console.

Navigate to:

IAM


↓


Users


↓


Select User

Review:

  • Console Access
  • MFA Status
  • Last Sign-in

Questions:

  • Which users do not have MFA enabled?
  • Which accounts represent the highest risk?

🧪 Enterprise Mission 02 — Enable MFA for an IAM User

Section titled “🧪 Enterprise Mission 02 — Enable MFA for an IAM User”

Navigate to:

IAM


↓


Users


↓


alice.dev


↓


Security Credentials


↓


Assign MFA Device

Choose:

Virtual MFA Device

Scan the QR code using an authenticator application.

Enter two consecutive MFA codes.

Save the configuration.

🧪 Enterprise Mission 03 — Verify MFA Login

Section titled “🧪 Enterprise Mission 03 — Verify MFA Login”

Sign out of the AWS Console.

Sign in again using:

  • Username
  • Password
  • MFA Code

Confirm successful authentication.

🧪 Enterprise Mission 04 — Review Root User MFA

Section titled “🧪 Enterprise Mission 04 — Review Root User MFA”

Sign in using the Root User.

Navigate to:

Account


↓


Security Credentials


↓


Multi-Factor Authentication

Verify that MFA is enabled.

If MFA is not configured, enable it.

🧪 Enterprise Mission 05 — List Virtual MFA Devices

Section titled “🧪 Enterprise Mission 05 — List Virtual MFA Devices”

Open PowerShell.

Run:

Terminal window
aws iam list-virtual-mfa-devices

Review:

  • Serial Number
  • Enable Date
  • Assigned User

🧪 Enterprise Mission 06 — Review IAM Account Summary

Section titled “🧪 Enterprise Mission 06 — Review IAM Account Summary”

Run:

Terminal window
aws iam get-account-summary

Review:

  • Users
  • MFA Devices
  • Password Policy
  • Account Security

Document your observations.

🧪 Enterprise Mission 07 — Simulated Security Incident

Section titled “🧪 Enterprise Mission 07 — Simulated Security Incident”

CloudNova receives an alert.

An attacker has obtained the password for:

john.security

Questions:

  • Can the attacker log in?
  • What happens if MFA is enabled?
  • What should the Security Team do next?

Document your response.

🧪 Enterprise Mission 08 — MFA Compliance Review

Section titled “🧪 Enterprise Mission 08 — MFA Compliance Review”

Review all CloudNova users.

Prepare a compliance report showing:

  • Users with MFA enabled.
  • Users without MFA.
  • High-risk accounts.
  • Recommendations.

🏢 Enterprise Scenario

Section titled “🏢 Enterprise Scenario”

CloudNova plans to expand globally.

The organisation will soon employ more than 1,000 users across multiple AWS accounts.

Management requires:

  • Mandatory MFA.
  • Centralised identity management.
  • Secure authentication for privileged users.
  • Compliance with industry security standards.

Prepare a recommendation for implementing MFA across the organisation.

📊 Knowledge Check

Section titled “📊 Knowledge Check”

  1. What is Multi-Factor Authentication?

  2. Why is MFA more secure than using a password alone?

  3. What are the three authentication factors?

  4. Why must the AWS Root User always use MFA?

  5. Which AWS identities commonly require MFA?

  6. Which CLI command lists virtual MFA devices?

  7. Why don’t IAM Roles require MFA?

  8. What should be done if an employee loses their MFA device?

  9. How does MFA reduce phishing risks?

  10. Why is MFA considered a security best practice?

📝 Assignment

Section titled “📝 Assignment”

Prepare an Enterprise MFA Implementation Guide.

Include:

  • What is MFA?
  • Authentication Factors
  • MFA Device Types
  • Root User Security
  • IAM User MFA
  • Enterprise MFA Policy
  • AWS CLI Commands Used
  • Screenshots
  • Lessons Learned

Length: 4–5 Pages

📋 Lesson Completion Checklist

Section titled “📋 Lesson Completion Checklist”
Task Status
Reviewed IAM User MFA Status ☐
Enabled MFA for an IAM User ☐
Verified MFA Login ☐
Reviewed Root User MFA ☐
Listed Virtual MFA Devices ☐
Reviewed IAM Account Summary ☐
Completed Security Incident Exercise ☐
Completed Compliance Review ☐
Completed Assignment ☐

💡 Key Takeaways

Section titled “💡 Key Takeaways”

After completing this lesson, you should understand:

  • Multi-Factor Authentication significantly improves AWS account security.
  • MFA combines multiple authentication factors to verify user identity.
  • The AWS Root User should always have MFA enabled.
  • Privileged IAM Users should use MFA to reduce the risk of unauthorised access.
  • Regular MFA compliance reviews help maintain a secure enterprise environment.

📚 Further Reading

Section titled “📚 Further Reading”
  • AWS IAM User Guide – Multi-Factor Authentication
  • AWS Security Best Practices
  • AWS IAM Best Practices
  • AWS Well-Architected Framework – Security Pillar
  • AWS IAM CLI Reference

🚀 Next Lesson

Section titled “🚀 Next Lesson”

➡️ Lesson 10 — AWS IAM Identity Center (AWS Single Sign-On)