Bird
Raised Fist0
AWScloud~30 mins

Multi-factor authentication setup in AWS - Mini Project: Build & Apply

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime

Start learning this pattern below

Jump into concepts and practice - no test required

or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
Multi-factor authentication setup
📖 Scenario: You are setting up a secure AWS environment for a small company. To protect user accounts, you want to enable multi-factor authentication (MFA) for the AWS Identity and Access Management (IAM) users.
🎯 Goal: Configure an IAM user with MFA enabled using AWS CLI commands and JSON policy documents.
📋 What You'll Learn
Create an IAM user named developer
Create a virtual MFA device named dev-mfa-device
Enable MFA for the developer user
Attach a policy that requires MFA for sensitive actions
💡 Why This Matters
🌍 Real World
MFA protects AWS accounts from unauthorized access by requiring a second verification step.
💼 Career
Cloud engineers and security specialists must configure MFA to secure cloud environments.
Progress0 / 4 steps
1
Create IAM user developer
Use the AWS CLI command to create an IAM user named developer.
AWS
Hint

Use the aws iam create-user command with the --user-name option.

2
Create a virtual MFA device named dev-mfa-device
Use the AWS CLI command to create a virtual MFA device named dev-mfa-device.
AWS
Hint

Use aws iam create-virtual-mfa-device with --virtual-mfa-device-name option.

3
Enable MFA for the developer user
Use the AWS CLI command to enable MFA for the IAM user developer by associating the virtual MFA device dev-mfa-device. Provide two consecutive MFA codes 123456 and 654321 as placeholders.
AWS
Hint

Use aws iam enable-mfa-device with the correct --user-name, --serial-number, and two authentication codes.

4
Attach an IAM policy requiring MFA for sensitive actions
Create a JSON policy document named mfa-required-policy.json that denies all actions unless MFA is present. Then attach this policy to the developer user using AWS CLI.
AWS
Hint

Create a JSON file with a policy that denies actions if MFA is not present, then attach it with aws iam put-user-policy.

Practice

(1/5)
1. What is the main purpose of enabling Multi-factor Authentication (MFA) on an AWS account?
easy
A. To allow multiple users to share the same password
B. To speed up the login process by skipping passwords
C. To add an extra layer of security by requiring a second verification step
D. To automatically reset passwords every 30 days

Solution

  1. Step 1: Understand MFA purpose

    MFA requires a user to provide two forms of identification, usually a password and a code from a device, to increase security.

  2. Step 2: Compare options

    Only To add an extra layer of security by requiring a second verification step describes adding a second verification step for better security, which is the core of MFA.

  3. Final Answer:

    To add an extra layer of security by requiring a second verification step -> Option C

  4. Quick Check:

    MFA purpose = extra security step [OK]
Hint: MFA means two steps to prove identity, not faster login [OK]
Common Mistakes:
  • Thinking MFA speeds up login
  • Confusing MFA with password sharing
  • Assuming MFA resets passwords automatically
2. Which AWS CLI command correctly enables a virtual MFA device for a user named alice?
easy
A. aws iam enable-mfa-device --user-name alice --serial-number arn:aws:iam::123456789012:mfa/alice --authentication-code1 123456 --authentication-code2 654321
B. aws iam create-mfa-device --user alice --code1 123456 --code2 654321
C. aws iam add-mfa --username alice --device arn:aws:mfa:alice --codes 123456 654321
D. aws iam setup-mfa-device --user alice --serial arn:aws:iam::123456789012:mfa/alice --code 123456

Solution

  1. Step 1: Identify correct AWS CLI command syntax

    The command to enable an MFA device is aws iam enable-mfa-device with parameters for user name, serial number, and two consecutive authentication codes.

  2. Step 2: Match options to syntax

    aws iam enable-mfa-device --user-name alice --serial-number arn:aws:iam::123456789012:mfa/alice --authentication-code1 123456 --authentication-code2 654321 matches the correct command and parameters exactly. Other options use incorrect commands or missing parameters.

  3. Final Answer:

    aws iam enable-mfa-device --user-name alice --serial-number arn:aws:iam::123456789012:mfa/alice --authentication-code1 123456 --authentication-code2 654321 -> Option A

  4. Quick Check:

    Enable MFA CLI command = aws iam enable-mfa-device --user-name alice --serial-number arn:aws:iam::123456789012:mfa/alice --authentication-code1 123456 --authentication-code2 654321 [OK]
Hint: Enable MFA uses 'enable-mfa-device' with two codes [OK]
Common Mistakes:
  • Using 'create-mfa-device' instead of 'enable-mfa-device'
  • Providing only one authentication code
  • Incorrect parameter names or missing serial number
3. Given this AWS CLI command sequence, what will be the output status of the MFA device for user bob? 
aws iam create-virtual-mfa-device --virtual-mfa-device-name bob-mfa --outfile /tmp/bob-mfa.png
aws iam enable-mfa-device --user-name bob --serial-number arn:aws:iam::123456789012:mfa/bob-mfa --authentication-code1 123456 --authentication-code2 654321
aws iam list-mfa-devices --user-name bob
medium
A. An error will occur because the authentication codes are missing
B. No MFA devices will be listed for user bob
C. The virtual MFA device will be created but not enabled
D. The MFA device named 'bob-mfa' will be listed as active for user bob

Solution

  1. Step 1: Understand command sequence

    The first command creates a virtual MFA device and outputs a QR code image. The second command enables this MFA device for user bob using two authentication codes. The third command lists all MFA devices for bob.

  2. Step 2: Predict output of list command

    Since the device was created and enabled successfully, the list command will show the 'bob-mfa' device as active for user bob.

  3. Final Answer:

    The MFA device named 'bob-mfa' will be listed as active for user bob -> Option D

  4. Quick Check:

    Created and enabled MFA device appears in list [OK]
Hint: Create then enable MFA device before listing to see it [OK]
Common Mistakes:
  • Assuming device is listed before enabling
  • Thinking missing codes cause error here
  • Confusing creation with enabling steps
4. A user tries to enable MFA with this command but gets an error: 
aws iam enable-mfa-device --user-name carol --serial-number arn:aws:iam::123456789012:mfa/carol --authentication-code1 123456
What is the most likely cause of the error?
medium
A. Only one authentication code was provided instead of two
B. The serial number ARN is incorrect format
C. The user name 'carol' does not exist
D. The command should use 'create-mfa-device' instead

Solution

  1. Step 1: Review command requirements

    The enable-mfa-device command requires two consecutive authentication codes to verify the MFA device setup.

  2. Step 2: Identify missing parameter

    The command only provides one authentication code (authentication-code1) and misses the second (authentication-code2), causing the error.

  3. Final Answer:

    Only one authentication code was provided instead of two -> Option A

  4. Quick Check:

    Enable MFA needs two codes, missing one causes error [OK]
Hint: Enable MFA requires two codes, not one [OK]
Common Mistakes:
  • Providing only one authentication code
  • Assuming ARN format error without checking codes
  • Confusing enable with create commands
5. You want to enforce MFA for all IAM users in your AWS account to improve security. Which approach is the best practice to achieve this?
hard
A. Use a single MFA device shared by all users to simplify management
B. Create an IAM policy that denies all actions unless MFA is used, then attach it to all users
C. Require users to change passwords every 30 days instead of using MFA
D. Manually enable MFA on each user without any policy enforcement

Solution

  1. Step 1: Understand MFA enforcement methods

    To enforce MFA, you need a policy that denies actions unless MFA is present. This ensures users cannot bypass MFA even if enabled.

  2. Step 2: Evaluate options for best practice

    Create an IAM policy that denies all actions unless MFA is used, then attach it to all users uses an IAM policy to enforce MFA for all users, which is scalable and secure. Other options either lack enforcement or reduce security.

  3. Final Answer:

    Create an IAM policy that denies all actions unless MFA is used, then attach it to all users -> Option B

  4. Quick Check:

    Enforce MFA with deny policy = Create an IAM policy that denies all actions unless MFA is used, then attach it to all users [OK]
Hint: Use deny policy requiring MFA for all users [OK]
Common Mistakes:
  • Relying on manual enabling without enforcement
  • Using password rotation instead of MFA
  • Sharing one MFA device among users