Set up MFA on AWS with OTPilot
AWS calls an authenticator app a virtual MFA device. OTPilot works as one: it saves the device from the console's setup wizard and fills the MFA code when you sign in.
Assign the MFA device
- Sign in to the AWS Management Console. On the right of the navigation bar, choose your account name → Security credentials.
- In the Multi-Factor Authentication (MFA) section, choose Assign MFA device.
- Type a device name, choose Authenticator app, then Next.
- Choose Show QR code. OTPilot detects it and offers to save the account: click Add account. If the prompt doesn't appear, choose Show secret key, then in OTPilot click + → 2FA code: paste the key, give it a name, enter signin.aws.amazon.com as the site, and click Save.
- AWS asks for two consecutive codes: type the current code from OTPilot in MFA code 1, wait for the next one (up to 30 seconds) and type it in MFA code 2. Choose Add MFA.
Submit right after typing the second code: if you wait too long, AWS can register the device out of sync.
A backup you can count on
AWS lets you register up to eight MFA devices. Adding a second one (a security key, or the same secret on another device) means losing one never locks you out of the account.
Questions
- Does it work for IAM users too?
- Yes: an IAM user can assign an MFA device from its own Security credentials page the same way (if its permissions allow it, or an administrator does it from IAM), and OTPilot fills the code at sign-in.
Password manager with built-in 2FA
Fills your password and your 2FA code on any login page. End-to-end encrypted, synced across devices, free to start.