> For the complete documentation index, see [llms.txt](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aws-gcr-wwso-security.gitbook.io/an-quan-zui-jia-shi-jian/1.-iam-shen-fen-shi-bie-yu-fang-wen-kong-zhi/xin-shou-qi-bu/tian-jia-xu-ni-mfa-huo-ying-jian-mfa.md).

# 添加虚拟MFA或硬件MFA

To enhance the security of your AWS account, adding a virtual Multi-Factor Authentication (MFA) device is a recommended step. With AWS, you can either add a virtual MFA to your root account or to an individual Identity and Access Management (IAM) user. This additional layer of security ensures that your account remains protected against unauthorized access.

## 添加虚拟MFA

Virtual authenticator apps implement the [time-based one-time password](https://datatracker.ietf.org/doc/html/rfc6238) (TOTP) algorithm and support multiple tokens on a single device. Virtual authenticators are supported for IAM users in the [AWS GovCloud (US) Regions](https://aws.amazon.com/govcloud-us/) and in other AWS Regions. For more information about enabling virtual authenticators, see [Enabling a virtual multi-factor authentication (MFA) device](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html).

You can install apps for your smartphone from the app store that is specific to your type of smartphone. Some app providers also have web and desktop applications available. See the following table for examples.

| Android | [Twilio Authy Authenticator](https://play.google.com/store/apps/details?id=com.authy.authy), [Duo Mobile](https://play.google.com/store/apps/details?id=com.duosecurity.duomobile), [Microsoft Authenticator](https://play.google.com/store/apps/details?id=com.azure.authenticator), [Google Authenticator](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2), [Symantec VIP](https://m.vip.symantec.com/home.v#searchwebsite) |
| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| iOS     | [Twilio Authy Authenticator](https://apps.apple.com/us/app/authy/id494168017), [Duo Mobile](https://apps.apple.com/us/app/duo-mobile/id422663827), [Microsoft Authenticator](https://apps.apple.com/us/app/microsoft-authenticator/id983156458), [Google Authenticator](https://apps.apple.com/us/app/google-authenticator/id388497605), [Symantec VIP](https://m.vip.symantec.com/home.v#searchwebsite)                                                            |

To add a virtual MFA device, see one of the following:

* [Enable a virtual MFA device for your AWS account root user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-virt-mfa-for-root.html)
* [Enable a virtual MFA device for an IAM user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_virtual.html#enable-virt-mfa-for-iam-user)

## 添加硬件MFA

需要<mark style="color:blue;">**首先购买一个硬件MFA**</mark>，支持FIDO标准的安全密钥security key，或者TOTP token。FIDO Alliance维护了所有支持FIDO2标准的 [FIDO2 products](https://fidoalliance.org/certification/fido-certified-products/) 清单。可以从该网站查询可用的安全密钥。**推荐购买yubico的security key**：<https://www.yubico.com/sg/product/security-key-series/security-key-nfc-by-yubico-black/>

然后<mark style="color:blue;">**将硬件MFA插到您所使用的电脑上**</mark>，在控制台中配置，配置步骤如下：

To add a FIDO security key, see one of the following:

* [Enable a FIDO security key for the AWS account root user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-fido-mfa-for-root.html)
* [Enable a FIDO security key for another IAM user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_fido.html#enable-fido-mfa-for-iam-user)

To add a hardware MFA device, see one of the following:

* [Enable a hardware TOTP token for the AWS account root user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/enable-hw-mfa-for-root.html).
* [Enable a hardware TOTP token for another IAM user (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_physical.html#enable-hw-mfa-for-iam-user)

**Hardware TOTP tokens**

Hardware tokens also support the [TOTP algorithm](https://datatracker.ietf.org/doc/html/rfc6238) and are provided by Thales, a third-party provider. These tokens are for use exclusively with AWS accounts. For more information, see [Enabling a hardware MFA device](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_physical.html).

You can purchase these tokens directly from the manufacturers as a [key fob](https://smile.amazon.com/SafeNet-IDProve-Time-based-6-Digit-Services/dp/B002CRN5X8) or [display card device](https://smile.amazon.com/SafeNet-IDProve-Card-Amazon-Services/dp/B00J4NGUO4).

**Hardware TOTP tokens for the AWS GovCloud (US) Regions**

Hardware TOTP tokens are compatible with the [AWS GovCloud (US) Regions](https://aws.amazon.com/govcloud-us/) and are provided by Hypersecu, a third-party provider. These tokens are for use exclusively by IAM users with AWS GovCloud (US) accounts.

You can purchase these tokens directly from the manufacturer as a [key fob](https://smile.amazon.com/dp/B09RQ96HBP).

<https://aws.amazon.com/iam/features/mfa/>