Multi-factor authentication setup in AWS - Step-by-Step Execution

Process Flow - Multi-factor authentication setup

Start MFA Setup

↓

User logs into AWS Console

↓

Navigate to IAM User Settings

↓

Select MFA Device Type

↓

Activate MFA Device

↓

Scan QR Code with Authenticator App

↓

Enter MFA Codes Twice

↓

MFA Device Enabled

↓

User must enter MFA code on login

This flow shows the step-by-step process of setting up MFA for an AWS user, from login to enabling the device and requiring MFA on future logins.

Execution Sample

AWS

aws iam enable-mfa-device \
  --user-name Alice \
  --serial-number arn:aws:iam::123456789012:mfa/Alice \
  --authentication-code1 123456 \
  --authentication-code2 789012

This command enables a virtual MFA device for user Alice by providing two consecutive MFA codes from the authenticator app.

Process Table

Step	Action	Input/Condition	Result
1	User logs into AWS Console	User credentials correct	Access granted to console
2	Navigate to IAM User Settings	User selects own settings	IAM user page opens
3	Select MFA Device Type	Choose virtual MFA device	QR code generated
4	Scan QR Code	User scans with app	App linked to AWS account
5	Enter MFA Code 1	User inputs first 6-digit code	Code accepted
6	Enter MFA Code 2	User inputs second 6-digit code	Code accepted, device enabled
7	MFA Device Enabled	Device linked to user	Future logins require MFA code
8	User logs out and logs in again	User enters username and password	Prompted for MFA code
9	User enters MFA code	Correct code entered	Login successful
10	User enters MFA code	Incorrect code entered	Login denied
11	Exit	Setup complete	MFA enforced on user login

💡 Setup completes after enabling MFA device and verifying codes; MFA required on future logins

Status Tracker

Variable	Start	After Step 4	After Step 6	After Step 7	After Step 9
MFA Device Status	Not enabled	Linked to app	Enabled	Enabled	Enabled
User Login State	Logged out	Logged in	Logged in	Logged out	Logged in with MFA
MFA Code Validity	N/A	N/A	N/A	N/A	Valid or Invalid depending on input

Key Moments - 3 Insights

Why do we need to enter two MFA codes during setup?

Entering two consecutive codes proves the authenticator app is synced correctly, as shown in steps 5 and 6 of the execution_table.

What happens if the user enters the wrong MFA code on login?

The login is denied as shown in step 10 of the execution_table, ensuring security by blocking access without correct MFA.

Is MFA required immediately after enabling the device?

Yes, after step 7, MFA is enforced on all future logins, as shown in steps 8 and 9.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the MFA device officially enabled?

A Step 4

B Step 8

C Step 6

D Step 10

💡 Hint

Check the 'Result' column for when the device is marked as enabled.

According to variable_tracker, what is the MFA Device Status after Step 4?

A Enabled

B Linked to app

C Not enabled

D Invalid

💡 Hint

Look at the 'MFA Device Status' row under 'After Step 4' column.

If the user enters an incorrect MFA code at login, what is the expected result according to the execution_table?

A Login denied

B Prompted to enter password again

C Login successful

D MFA device disabled

💡 Hint

Refer to step 10 in the execution_table under 'Result'.

Concept Snapshot

Multi-factor authentication (MFA) adds a second step to AWS login.
Setup involves linking a virtual MFA device via QR code.
User must enter two consecutive codes to enable MFA.
After setup, MFA code is required on every login.
This improves account security by requiring something you know (password) and something you have (MFA device).

Full Transcript

This visual execution shows how to set up multi-factor authentication (MFA) for an AWS user. The user logs into the AWS console, navigates to their IAM settings, and selects a virtual MFA device. A QR code is generated and scanned with an authenticator app. The user then enters two consecutive MFA codes to verify and enable the device. Once enabled, future logins require the user to enter an MFA code along with their password. If the code is correct, login succeeds; if incorrect, login is denied. This process strengthens security by requiring two forms of verification.