AWS Two-Factor Authentication: Codes, Backups and Fixes

AWS two-factor authentication adds a second code to your sign-in. The safest setup is an authenticator app plus saved backup codes, with text messages only as a fallback.

What AWS offers

MFA for the root user and IAM users can use an authenticator app, a security key or a passkey (Security credentials). AWS recommends MFA on the root user and using IAM or Identity Center users for daily work.

Two-factor methods compared

Turn it on the safe way

1. Open AWS's security settings and choose two-factor or two-step verification.
2. Pick the authenticator app option if there is one, and scan the QR code with an app such as Google Authenticator or Microsoft Authenticator.
3. Enter the 6-digit code the app shows to confirm.
4. Save the backup or recovery codes somewhere offline, such as a password manager or on paper.
5. Add text messages only as a backup method.

When the code does not work or arrive

• Authenticator codes depend on the clock: set your phone's date and time to automatic.
• Text codes can land in spam or "unknown senders"; check there before asking again.
• Ask for a new text code once, then wait; repeated requests can lock you out for a while.
• Use a backup code if nothing else works.

Lost your phone?

If the root user's MFA device is gone, use the troubleshooting link on the sign-in page; AWS checks the account email and phone, and AWS Support can help. If you have neither the phone nor the codes, AWS's account recovery process is the way back, and it can take days.

Should you use a second number for two-factor?

Prefer an authenticator app: it works without signal and cannot be stolen by a SIM swap. If AWS only offers text messages and you want them on a separate number, use a number you keep for months, never a one-time number, because that number goes to someone else afterwards. A rental number for AWS stays yours for the days you pay for.

FAQ

Is text-message two-factor on AWS safe?

It is much better than no two-factor, but an authenticator app or security key is safer, because text codes can be intercepted after a SIM swap.

What are backup codes?

One-time codes you save when you turn on two-factor. Each works once and gets you in when your phone is not available.

Can I turn off two-factor on AWS?

Yes, from the security settings after you sign in, but it makes the account easier to take over.

What if I lost my authenticator app?

Sign in with a backup code and set it up again. Without codes, use the account recovery process.

Can I move my authenticator to a new phone?

Yes: most authenticator apps can transfer or back up accounts. Do it before you reset the old phone.

Why does AWS ask for a code every time?

Clearing cookies or using private browsing makes the device look new. Allow cookies and choose to trust the device if offered.

Related: AWS number · AWS account recovery · create aws account without real phone number · aws verification code not received · verification code not received on any app.