Issue With IAM Supporting Multiple MFA Devices

Initial Publication Date: 04/25/2023 10:00AM EST

A security researcher recently reported an issue with AWS’s recently-released (November 16th, 2022) support for multiple multi-factor authentication (MFA) devices for IAM user principals. The reported issue could have potentially arisen only when the following three conditions were met: (1) An IAM user had possession of long-term access key (AK)/secret key (SK) credentials, (2) that IAM user had the privilege to add an MFA to their own identity without using an MFA, and (3) …

access authentication aws beyond conditions console credentials devices factor iam identity issue key mfa multi-factor multi-factor authentication november own privilege privileges researcher secret secret key security security researcher sign support