2

I would like to secure an AWS root account with a hardware MFA device, which seems to be simple enough, but I also want a backup device to store in a different location. AWS doesn't seem to support multiple MFA devices on the same account, but if I could get a synchronized pair of MFA devices they would effectively be a single device to AWS.

Is it possible to buy pairs of such devices?

Improve this question
1
  • Worth noting: AWS now supports multiple MFA hardware keys. But you can special-order YubiKeys to have the same seed.
    – Michael come lately
    Commented Jul 12 at 16:16

3 Answers 3

Reset to default
2

You can buy hardware devices, that can be seeded like the Yubikey, the etoken pass or some Feitian tokens. Thus you can put the same seed provided by AWS on multiple hardware devices.

Improve this answer
1
  • Any documentation available on how to do that? My objective is to use an hardware MFA in AWS console to pass CIS.1.14 (The root user is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the root user be protected with a hardware MFA)
    – Tony
    Commented Aug 10, 2022 at 22:12
4

If you use the virtual one, you can print the QR code and/or write down the secret. Multiple Google Authenticators can scan the same code, or you can type it in manually to Google Authenticator.

Improve this answer
1

Im not sure that what you are describing is possible. The point of external security keys is, that all operation happen INSIDE the key. If you could plants something inside the key, well, that would violate this principle. Maybe there are something that allows this, but I dont know any.

The best solutions is to buy 3-4 Yubikeys /etc. and just register them all to whatever website or servers wants to use them as MFA. Then you carry no1 with you, no2 keep at home safe place protected by fire etc. and no3 you keep outside of your house, physically separated etc. and if you have no4 keep it even further like in bank vault to be sure not to loose them all.

Also mark the keys like 1,2,3,4 and name them in the server/service/webpage as the same. This way if you loose one key you can disable that key and only that key from the server/service/webpage. Otherwise you have no idea which key is which.

BTW. Make sure you use them correctly: Some services like to use them as passkeys and not really 2FA:s. Make sure you use them as 2FA:s only and that they are not accidently marked and used as passkeys. Passkeys = 1FA = bad idea in security perspective. If you use passkeys to sign in, you should have TOTP or email/phone verification codes for 2FA.

Improve this answer
1
  • Well, it is possible (it always has been).. whether it is smart is the question. There are use cases where a shared hardware secured secret suffices. For those you wouldn’t need your scheme to support them at all. It all hinges on what threat you are trying to protect against. And what requirements does your protection need to have.
    – LvB
    Commented Jul 14 at 10:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .