How to set up 2FA on AWS
Checked against AWS's own help on 10 October 2026. Menus change, so follow the nearest label if yours differs.
Short answer
Open AWS's security settings (Account name, Security credentials, Assign MFA device), choose the authenticator app option, and scan the QR code AWS shows with KeyNesta (or enter the setup key by hand). Type the six-digit code KeyNesta shows back into AWS to finish, and save the recovery material AWS gives you before you close the page.
Before you start
Have KeyNesta open and unlocked before AWS shows the QR code, so the code is ready the moment it appears. KeyNesta needs no account to do this. It stores authenticator-app codes only: it does not do passkeys or hardware security keys, and where AWS offers those you set them up in AWS directly.
Steps
- Sign in to the AWS Management Console with your root user credentials. (Enabling MFA on the root user needs the root sign-in.)
- On the right of the navigation bar, choose your account name, then Security credentials.
- In the Multi-Factor Authentication (MFA) section, choose Assign MFA device.
- In the wizard, type a Device name, choose Authenticator app, then Next.
- Choose Show QR code. AWS shows the QR code, and also a Show secret key option.
- Add it to KeyNesta. Open the KeyNesta web app (or the app on your phone once it is released), unlock your vault, choose Scan QR and point the camera at the code on screen. If you cannot scan, use Import QR image, or choose Add entry to paste the setup key.
- In MFA code 1, type the code KeyNesta shows now.
- Wait up to 30 seconds for KeyNesta to roll to the next code and type that into MFA code 2, then choose Add MFA.
| AWS | What to know |
|---|---|
| Where to start | Account name, Security credentials, Assign MFA device |
| Setup key as text | In the Set up device wizard, choose Show secret key and type or paste it into KeyNesta. |
| Recovery material | AWS's help does not describe recovery codes for a virtual MFA device. |
| Source | AWS IAM User Guide: Enable a virtual MFA device for the root user |
Backup and recovery for AWS
AWS's help does not describe recovery codes for a virtual MFA device. It tells you to keep a secure backup of the QR code or secret key, or to register more than one MFA device: up to eight per root user or IAM user. The QR code and key are tied to your account and can be reused to configure a new MFA device if you lose the original.
Save whatever AWS gives you somewhere that is not the phone holding your codes. Where to store your 2FA backup codes compares the options, and 2FA backup and sync covers backing up the KeyNesta vault itself.
Things to know about AWS
- AWS asks for two consecutive codes. Submit right after generating the second one, or the device is registered but out of sync (AWS has a resync procedure).
- This is the root-user route. IAM users get an MFA device from their own Security credentials page or from an administrator.
Source
Menu paths on this page come from AWS IAM User Guide: Enable a virtual MFA device for the root user, read on 10 October 2026. KeyNesta is not affiliated with AWS.
Frequently asked questions
Can I use KeyNesta as the authenticator app for AWS?
Yes. AWS asks for a standard time-based code, and KeyNesta reads the same QR code or setup key and generates that code on your device, offline. AWS does not learn which app you chose. KeyNesta holds authenticator-app codes only; it has no passkey or hardware security key support. How to add the code is in How do I add a 2FA code to KeyNesta?
What happens to my AWS 2FA if I lose my phone?
Sign in with another registered MFA device if you added one, or use AWS's root user MFA recovery process. With no other device and no recovery, AWS says you must contact customer service to remove MFA. If your KeyNesta vault is synced or you made an encrypted backup, you can restore the codes on another device; the lost phone guide covers the order to do things in.
How do I add AWS to KeyNesta if I cannot scan the QR code?
In the Set up device wizard, choose Show secret key and type or paste it into KeyNesta. In KeyNesta you can also upload a screenshot with Import QR image, paste an otpauth:// link, or add the entry by hand with the secret. Delete any screenshot of the QR afterwards: it works like a password.
Can I use the same AWS code on two devices?
Codes come from a shared secret, so any app that holds the secret shows the same codes. The tidy way is KeyNesta's optional end-to-end encrypted sync, which carries the vault to a second device. The alternative is to add the secret to a second app while the QR code is still on screen; once AWS stops showing it, you cannot get it back without re-enrolling.
Can I use other MFA types with AWS as well as KeyNesta?
AWS lets you register up to eight MFA devices of any mix of its supported types on the same user. Keep KeyNesta as one authenticator-app device and add a second device as a spare. KeyNesta itself supports authenticator-app codes only, not security keys or passkeys.
Why does AWS ask for two MFA codes when I set up 2FA?
AWS's help has you enter two consecutive one-time codes. Type the first, wait up to 30 seconds for KeyNesta to show the next one, type that, and submit straight away: AWS warns that waiting too long registers the device but leaves it out of sync, which needs a resync.
Should I keep the AWS secret key after I scan the QR code?
AWS's help says to make a secure backup of the QR code or secret key, or to register more than one device, because losing the only device can mean contacting customer service. Keeping the key in an encrypted place, not in a screenshot folder, is the safer of the two. A second registered device is better still.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms