MFA & Least Privilege
Add multi-factor authentication for sign-in security, and grant only the minimum permissions each identity needs.
Two habits protect your account more than anything else: MFA and least privilege.
Multi-Factor Authentication (MFA)
MFA requires a second factor — a code from an authenticator app or hardware key — on top of a password. Even if a password leaks, an attacker cannot sign in without the device.
- Enable MFA on the root user first.
- Require MFA for all human IAM users.
- You can even require MFA in a policy condition to allow sensitive actions.
Least Privilege
The principle of least privilege means giving each user or role only the permissions it actually needs — nothing more. Start with no access and add permissions as required, rather than starting broad and trimming.
Use IAM Access Analyzer and the Access Advisor tab to find and remove unused permissions.
Example
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"BoolIfExists": { "aws:MultiFactorAuthPresent": "false" }
}
}
]
}When to use it
- An administrator enforces MFA for all IAM users so that a stolen password alone cannot grant AWS Console access.
- A developer is given only s3:GetObject on a single bucket rather than AmazonS3FullAccess, limiting blast radius if the credentials are compromised.
- A production deployment role grants only the specific Lambda and CloudFormation permissions the pipeline needs, with no IAM or billing access.
More examples
Enforce MFA with IAM Policy
Denies all API actions unless the request includes a valid MFA token, enforcing MFA for every sensitive operation.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"BoolIfExists": {
"aws:MultiFactorAuthPresent": "false"
}
}
}]
}Check if User Has MFA Device
Lists MFA devices registered to a user, letting you audit which users have or have not enrolled an MFA device.
aws iam list-mfa-devices \
--user-name alice \
--query 'MFADevices[].{Serial:SerialNumber,Enabled:EnableDate}' \
--output tableSimulate Least-Privilege Policy
Simulates whether a role can perform specific actions without actually calling them, validating least-privilege configuration.
aws iam simulate-principal-policy \
--policy-source-arn arn:aws:iam::123456789012:role/AppRole \
--action-names s3:PutObject s3:DeleteObject \
--resource-arns arn:aws:s3:::my-bucket/* \
--query 'EvaluationResults[].{Action:EvalActionName,Decision:EvalDecision}' \
--output table
Discussion