AWS calls it a virtual MFA device and asks for two consecutive codes, so you must wait out a full 30-second step during enrolment.
Service aws.amazon.comAlgorithm SHA-1Step 30sDigits 6
or drop an image here
Advanced
Waiting for a keypaste one above to start27
——————
Where AWS IAM hides the key
IAM → Users → your user → Security credentials → Assign MFA device.
Choose Authenticator app, then Show secret key.
Paste the key above. AWS now wants two codes in a row: enter the current one, wait for the ring to reset, enter the next.
Root account firstEnable MFA on the root user before any IAM user. An unprotected root account undoes every other control in the account.
Parameters AWS IAM issues
Algorithm
SHA-1, the RFC 6238 default.
Period
30 seconds
Digits
6
URI format
otpauth://totp/AWS IAM:you@aws.amazon.com?secret=…&issuer=AWS IAM. Paste the whole URI above and the label fills itself in.
If the key is gone
Another IAM admin can deactivate and reassign the MFA device.
Root user lockout. AWS runs a phone and email verification against the account contact details. If those are stale, recovery can fail outright.
Questions
Why does AWS ask for two codes?
It proves the secret is synchronised across a step boundary rather than copied once. Enter the current code, wait for the next 30-second window, and enter that one.