AWS IAM documentation change
Summary
Added cross-device authentication (CDA) details and reorganized passkey documentation
Security assessment
The changes enhance documentation about MFA passkey capabilities but do not address a specific security vulnerability. The updates provide clearer guidance about security features (FIDO authentication methods) without indicating a security incident.
Diff
diff --git a/IAM/latest/UserGuide/enable-mfa-for-root.md b/IAM/latest/UserGuide/enable-mfa-for-root.md index c6fcac571..1162adf2d 100644 --- a//IAM/latest/UserGuide/enable-mfa-for-root.md +++ b//IAM/latest/UserGuide/enable-mfa-for-root.md @@ -45 +45 @@ AWS Identity and Access Management supports passkeys and security keys for MFA. -You can use built-in biometric authenticators, like Touch ID on Apple MacBooks, to unlock your credential manager and sign in to AWS. Passkeys are created with your chosen provider using your fingerprint, face, or device PIN. You can sync passkeys across your devices to facilitate sign-ins with AWS, enhancing usability and recoverability. +You can use built-in biometric authenticators, like Touch ID on Apple MacBooks, to unlock your credential manager and sign in to AWS. Passkeys are created with your chosen provider using your fingerprint, face, or device PIN. You can also use a cross-device authentication (CDA) passkey from one device, like a mobile device or hardware security key, to sign in on another device like a laptop. For more information, see [cross-device authentication](https://passkeys.dev/docs/reference/terms/#cross-device-authentication-cda) (CDA). @@ -47 +47,3 @@ You can use built-in biometric authenticators, like Touch ID on Apple MacBooks, -IAM does not support local passkey registration for Windows Hello. To create and use passkeys, Windows users should use [cross-device authentication](https://passkeys.dev/docs/reference/terms/#cross-device-authentication-cda) where you use a passkey from one device like a mobile device or hardware security key to sign in on another device like a laptop. The FIDO Alliance maintains a list of all [FIDO Certified products](https://fidoalliance.org/certification/fido-certified-products/) that are compatible with FIDO specifications. For more information about enabling passkeys and security keys, see [Enable a passkey or security key for the root user (console)](./enable-fido-mfa-for-root.html). +You can sync passkeys across your devices to facilitate sign-ins with AWS, enhancing usability and recoverability. For more information about enabling passkeys and security keys, see [Enable a passkey or security key for the root user (console)](./enable-fido-mfa-for-root.html). + +The FIDO Alliance maintains a list of all [FIDO Certified products](https://fidoalliance.org/certification/fido-certified-products/) that are compatible with FIDO specifications.