c1.4 Enforce multi-factor authentication
Require a second authentication factor everywhere. AWS now enforces MFA for the root user of every account, and you should extend MFA to all human access — ideally with phishing-resistant passkeys or FIDO2 security keys.
Implementation guidance
MFA is now required for root
AWS enforces MFA for the root user across all account types (standalone, management, and member). Users must register MFA within 35 days of first console sign-in if it is not already enabled. Configure it before AWS forces the prompt, and register more than one device — an account root user or IAM user can register up to eight MFA devices, so losing one does not lock you out.
Prefer phishing-resistant factors
Supported MFA types include passkeys and FIDO2 security keys (phishing-resistant, recommended), virtual authenticator apps (TOTP), and hardware TOTP tokens. Prefer passkeys/FIDO2 where you can; they resist the credential-phishing that defeats TOTP codes.
MFA for everyone, everywhere
Extend MFA beyond root: to every human identity in your identity provider / IAM Identity Center, and to your application end users via Amazon Cognito. Where always-on MFA hurts UX, adaptive (context-aware) authentication prompts for MFA only on anomalies (new device, new country, unusual behavior) — supported by both IAM Identity Center and Cognito.
Avoid long-lived IAM users with access keys; prefer federated, temporary credentials so there is no durable secret to steal.
How to validate
- Is MFA enabled on ALL root users (or centralized root with member-account root disabled via SCP)?
- Are you using phishing-resistant factors (passkeys / FIDO2) for privileged access?
- Is your identity provider / IAM Identity Center requiring MFA for all employees?
- Do you still have IAM users with access keys instead of federated temporary credentials?
- Is MFA offered for your application end users (CIAM) on critical actions?
Threats addressed
- ATT&CK Credential Access attackers acquire passwords through guessing, phishing, keyloggers, brute force, and dictionary attacks. A second factor ("something you have") blocks progress even when the password is known; phishing-resistant passkeys/FIDO2 also defeat real-time phishing of the second factor.
AWS services
AWS IAM 
AWS IAM Identity Center Pricing
There is no additional charge to enable MFA for AWS users or in Amazon Cognito. Passkeys use devices you already have; FIDO2 hardware security keys are a one-time purchase from third-party vendors.