Multi-Factor Authentication

Passwords alone are no longer sufficient to protect critical systems. Multi-Factor Authentication (MFA) adds a second verification factor beyond the password, significantly reducing the risk of unauthorized access from compromised passwords, phishing, or credential theft.

Objective

• Add an additional layer of security beyond passwords.
• Protect privileged and administrative accounts from unauthorized access.
• Reduce the risk of credential theft and phishing attacks.
• Strengthen the organization's overall security posture.
• Meet security and compliance requirements.

Solution

Implement MFA for all privileged and user accounts using trusted authenticator applications that generate time-based one-time passwords (TOTP):

• Authy
• Google Authenticator
• Microsoft Authenticator
• Okta Verify
• Duo Mobile

Where MFA is required

Account type	MFA requirement
AWS root user	Mandatory — see Root User Protection
IAM / Identity Center users	Mandatory for all administrators and engineers
Third-party consoles	GitHub, MongoDB Atlas, and cloud providers
Email / workspace admin	Mandatory, with periodic password rotation

Best practices

• Enforce MFA at the Identity Provider so it applies uniformly across federated AWS access.
• Prefer phishing-resistant factors (hardware keys / passkeys) for the most privileged roles.
• Never share TOTP seeds; enroll one device per user.
• Monitor and alert on MFA-disabled accounts using AWS Security Hub checks such as "IAM users without MFA."