AWS IAM high security documentation change
Summary
Added PowerShell V5 examples for creating virtual MFA devices with seed/QR code extraction and activation steps
Security assessment
The change directly documents enabling multi-factor authentication (MFA), a critical security control. Providing implementation details for MFA strengthens account security by reducing reliance on single-factor authentication.
Diff
diff --git a/IAM/latest/UserGuide/iam_example_iam_CreateVirtualMfaDevice_section.md b/IAM/latest/UserGuide/iam_example_iam_CreateVirtualMfaDevice_section.md index e0a715b22..338822c48 100644 --- a//IAM/latest/UserGuide/iam_example_iam_CreateVirtualMfaDevice_section.md +++ b//IAM/latest/UserGuide/iam_example_iam_CreateVirtualMfaDevice_section.md @@ -83,0 +84,40 @@ PowerShell +**Tools for PowerShell V5** + + +**Example 1: This example creates a new virtual MFA device. Lines 2 and 3 extract the`Base32StringSeed` value that the virtual MFA software program needs to create an account (as an alternative to the QR code). After you configure the program with the value, get two sequential authentication codes from the program. Finally, use the last command to link the virtual MFA device to the IAM user `Bob` and synchronize the account with the two authentication codes.** + + + $Device = New-IAMVirtualMFADevice -VirtualMFADeviceName BobsMFADevice + $SR = New-Object System.IO.StreamReader($Device.Base32StringSeed) + $base32stringseed = $SR.ReadToEnd() + $base32stringseed + CZWZMCQNW4DEXAMPLE3VOUGXJFZYSUW7EXAMPLECR4NJFD65GX2SLUDW2EXAMPLE + + +**Output:** + + + -- Pause here to enter base-32 string seed code into virtual MFA program to register account. -- + + Enable-IAMMFADevice -SerialNumber $Device.SerialNumber -UserName Bob -AuthenticationCode1 123456 -AuthenticationCode2 789012 + +**Example 2: This example creates a new virtual MFA device. Lines 2 and 3 extract the`QRCodePNG` value and write it to a file. This image can be scanned by the virtual MFA software program to create an account (as an alternative to manually entering the Base32StringSeed value). After you create the account in your virtual MFA program, get two sequential authentication codes and enter them in the last commands to link the virtual MFA device to the IAM user `Bob` and synchronize the account.** + + + $Device = New-IAMVirtualMFADevice -VirtualMFADeviceName BobsMFADevice + $BR = New-Object System.IO.BinaryReader($Device.QRCodePNG) + $BR.ReadBytes($BR.BaseStream.Length) | Set-Content -Encoding Byte -Path QRCode.png + + +**Output:** + + + -- Pause here to scan PNG with virtual MFA program to register account. -- + + Enable-IAMMFADevice -SerialNumber $Device.SerialNumber -UserName Bob -AuthenticationCode1 123456 -AuthenticationCode2 789012 + + * For API details, see [CreateVirtualMfaDevice](https://docs.aws.amazon.com/powershell/v5/reference) in _AWS Tools for PowerShell Cmdlet Reference (V5)_. + + + +