If you’ve already assigned an MFA device, like a YubiKey in U2F mode, you’ll need to remove it and then click “Assign MFA device”. Scroll down and click either “Manage MFA device” or “Assign MFA device” Log into the AWS Console, click your username in the upper right, and then click “My Security Credentials” from the dropdown menu Truly, a point and click adventure in Security 3. You’ll recall that a YubiKey does not have a watch, and we know it certainly does not have a camera to read QR codes, but let’s make it work anyway! 2. It’s going to be similar to adding a phone based authenticator (as I’m certain you have done before). Now, keep the terminal window open because we’re going to need it for the next series of steps. The command line tool is installed alongside the GUI version.

YubiKey Manager CLI (ykman) User Manual (click image for link) 1. Let’s start by getting that installed on a macOS (you may need to connect some dots for other systems, but the process is the same). There’s a CLI version of the YubiKey Manager dubbed ykman that supports our TOTP needs. Oh, but our computer sure does… Let’s see what libraries and tools Yubico has to offer. A YubiKey doesn’t have a watch, or any way to keep time.

That’s because AWS will accept that version of OATH and it can be used across the CLI, API, and Console. The solution: We need a way to do OATH-TOTP, which is time based. You can have any OATH you like, so long as it’s HOTP The answer: Only one two-factor authentication is allowed at a time, and the YubiKey Manager program seems to only offer OATH-HOTP, a flavor which AWS will not accept. When I first encountered this problem, I asked myself two questions: “Can I set my key to OTP instead?” and “Can I configure one 2FA for the Console and another for CLI?”. Use AWS API Commands from your terminal.Use AWS CLI Commands via Python libraries.Build Infrastructure as code with Terraform from your machine.What does that mean exactly? If you use a Yubikey for Universal 2nd Factor authentication (U2F) on your AWS Console, you cannot: Join me in my surprise then: By default, it won’t do both. Why Your YubiKey Won’t Work With AWS CLI (and the fix)ĭid you know you can use a YubiKey for 2FA when authenticating in AWS CLI or AWS Console? That sounds fairly obvious and expected.

Aws u2f