AWS wants to improve the security of its cloud environment and will therefore require multi-factor authentication for users starting next year. The administrators go first.

Amazon Web Services will require multi-factor authentication for its customers. AWS will phase in this commitment in early 2024. First it is the turn of the administrators. When someone logs in to the AWS Management Console with a root account, the cloud provider requires MFA to be configured before that person can proceed. Before that happens, the American cloud giant wants to raise awareness so that most users will hopefully proactively improve their security.

Ultimately, AWS will require MFA for multiple accounts. So-called standalone accounts are also high on the priority list. AWS is currently working on systems that will make it easier to manage MFA at scale, so ultimately everyone can have more security for their account.

Absolute minimum

Multi-factor authentication, where a username and password alone are not enough to log in, is actually the bare minimum for protecting sensitive accounts. The vast majority of successful cyberattacks leverage compromised account information and most of these attacks can be stopped simply by enabling MFA. The problem of reused or weak passwords or even phishing is much easier to deal with if someone also has to confirm their identity via an app, for example.

AWS rightly points out that no one should wait for next year’s requirement to enable MFA. The cloud provider offers several options such as hardware keys and an authenticator app on the phone. AWS no longer supports MFA via SMS.