Welcome back to Backspace Academy. In this lab on multi-factor authentication 2
we're going to be implementing mfa on the route user access and that is very 3
important because if you have an iam user compromised you can quite simply 4
delete that iam user but if you have your root access compromised then you 5
just won't have access at all and it will create a lot of problems if you 6
actually have your root user access compromised so it's vitally important 7
that you set up multi-factor authentication on root user so the first 8
thing we need to do is we need to download Authy so you go to authy.com 9
in the downloads section now there's a number of options for downloading you 10
can use any of these you can download it onto your mobile application for for iOS 11
or Android there's a desktop application as well for Mac and Windows 12
if your going to select the 64-bit windows make sure you're running 64-bit 13
windows otherwise we're going to have a problem and for Linux you should be able 14
to use Authy in your Chrome browser, so you should go use it with Chromium 15
I guess, I haven't tried that myself but that should work for Linux users so 16
download those I'd probably recommend you download both the desktop and the 17
mobile application because it's good to have both in case one goes a bit haywire 18
you've always got the other one as a backup, okay so once you've got Authy 19
downloaded just run the desktop app and set up your account so you need to put 20
in your country code and your phone number in there and then click on next 21
ok so once you've put in your phone number details if you used a landline 22
number you'll have to select phone call otherwise you can select SMS if you've 23
already setup or theme and you've already been using OAuth in the past you 24
can use your existing device to do that but just click on probably SMS you'll be 25
using a mobile or phone call to verify your account, ok so once we've got 26
Authy set up then can go back into the IAM management 27
console will go to the dashboard and you can see here on the security status 28
we've got a warning here that saying activate MFA on your root account so we 29
click the drop down there and we can manage MFA so we're going to be using a 30
virtual MFA device which is what Authy is it's a software application it's not 31
a hardware device and next steps and it's telling us to download and install 32
an MFA compatible application which is what Authy is so next step, okay so if 33
we're using the mobile application we can open it up and in the top right hand 34
corner there there'll be a drop down menu and what you can select 35
add account and then scan a QR code and when you scan that, that will 36
automatically add the AWS account to your virtual MFA device if you're using 37
the Authy desktop app you need to just cut and paste the actual key in there 38
and which is what I'm going to do now so just double click on that and copy it 39
and I'll copy that into orthey so what I do is I click on the plus sign for Authy 40
here and I'll just open that up here and I put that key in there now and I click 41
on Add Account so what it's going to do now and you don't have these options for 42
the mobile application it just automatically just puts it in for you 43
but what you can do is you can select whatever you want here so you'd be 44
scroll down you can see the icon for Amazon Web Services so just put that on 45
there and give your account a name as well, so I'm just going to call mine 46
backspace labs, make sure you don't call yours backspace Labs call yours whatever 47
something different other than backspace and click on save, okay so there we have 48
created for us our our account has been set up for multi-factor authentication 49
on Authy, so what we need to do now is get this this number here this eight one 50
seven five one nine and put it into here 51
okay and then we just go in your wait a while for it to change so it's now 52
changed so we just put the second one in there now okay so once we've got those 53
two authentication codes we can click on activate virtual MFA device so there we 54
have the MFA device has been successfully associated with your 55
account so if we now refresh the console 56
and we can see there that we've got activate MFA on our root account has got 57
a big green tick to it, so we've already done that so next time we log into our 58
MFA root accounts what will happen is that we'll put in our username and 59
password and there will be a second process where we have to put in this 60
number or this code from Authy. So that brings us to the end of the MFA lab 61
and make sure that you go and download the lab notes and follow this through 62
quite carefully because it's very important to set that up.