[{"data":1,"prerenderedAt":119},["ShallowReactive",2],{"i-heroicons:building-office-2":3,"i-heroicons:computer-desktop":8,"i-heroicons:cloud":10,"i-heroicons:server":12,"i-heroicons:folder":14,"i-heroicons:chart-bar":16,"i-heroicons:lock-closed":18,"i-heroicons:rectangle-stack":20,"i-heroicons:scale":22,"i-heroicons:key":24,"i-heroicons:finger-print":26,"i-heroicons:cpu-chip":28,"i-heroicons:document-text":30,"i-heroicons:shield-exclamation":32,"i-heroicons:shield-check":34,"blog-en-aws-mfa-login-with-yubikey":36,"i-heroicons:user":117},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 21h19.5m-18-18v18m10.5-18v18m6-13.5V21M6.75 6.75h.75m-.75 3h.75m-.75 3h.75m3-6h.75m-.75 3h.75m-.75 3h.75M6.75 21v-3.375c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125V21M3 3h12m-.75 4.5H21m-3.75 3.75h.008v.008h-.008zm0 3h.008v.008h-.008zm0 3h.008v.008h-.008z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M9 17.25v1.007a3 3 0 0 1-.879 2.122L7.5 21h9l-.621-.621A3 3 0 0 1 15 18.257V17.25m6-12V15a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 15V5.25m18 0A2.25 2.25 0 0 0 18.75 3H5.25A2.25 2.25 0 0 0 3 5.25m18 0V12a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 12V5.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 15a4.5 4.5 0 0 0 4.5 4.5H18a3.75 3.75 0 0 0 1.332-7.257a3 3 0 0 0-3.758-3.848a5.25 5.25 0 0 0-10.233 2.33A4.5 4.5 0 0 0 2.25 15\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M21.75 17.25v-.228a4.5 4.5 0 0 0-.12-1.03l-2.268-9.64a3.375 3.375 0 0 0-3.285-2.602H7.923a3.375 3.375 0 0 0-3.285 2.602l-2.268 9.64a4.5 4.5 0 0 0-.12 1.03v.228m19.5 0a3 3 0 0 1-3 3H5.25a3 3 0 0 1-3-3m19.5 0a3 3 0 0 0-3-3H5.25a3 3 0 0 0-3 3m16.5 0h.008v.008h-.008zm-3 0h.008v.008h-.008z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 12.75V12A2.25 2.25 0 0 1 4.5 9.75h15A2.25 2.25 0 0 1 21.75 12v.75m-8.69-6.44l-2.12-2.12a1.5 1.5 0 0 0-1.061-.44H4.5A2.25 2.25 0 0 0 2.25 6v12a2.25 2.25 0 0 0 2.25 2.25h15A2.25 2.25 0 0 0 21.75 18V9a2.25 2.25 0 0 0-2.25-2.25h-5.379a1.5 1.5 0 0 1-1.06-.44\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M3 13.125C3 12.504 3.504 12 4.125 12h2.25c.621 0 1.125.504 1.125 1.125v6.75C7.5 20.496 6.996 21 6.375 21h-2.25A1.125 1.125 0 0 1 3 19.875zm6.75-4.5c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125v11.25c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125zm6.75-4.5c0-.621.504-1.125 1.125-1.125h2.25C20.496 3 21 3.504 21 4.125v15.75c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M16.5 10.5V6.75a4.5 4.5 0 1 0-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 0 0 2.25-2.25v-6.75a2.25 2.25 0 0 0-2.25-2.25H6.75a2.25 2.25 0 0 0-2.25 2.25v6.75a2.25 2.25 0 0 0 2.25 2.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M6 6.878V6a2.25 2.25 0 0 1 2.25-2.25h7.5A2.25 2.25 0 0 1 18 6v.878m-12 0q.354-.126.75-.128h10.5q.396.002.75.128m-12 0A2.25 2.25 0 0 0 4.5 9v.878m13.5-3A2.25 2.25 0 0 1 19.5 9v.878m0 0a2.3 2.3 0 0 0-.75-.128H5.25q-.396.002-.75.128m15 0A2.25 2.25 0 0 1 21 12v6a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 18v-6c0-.98.626-1.813 1.5-2.122\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":23},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M12 3v17.25m0 0c-1.472 0-2.882.265-4.185.75M12 20.25c1.472 0 2.882.265 4.185.75M18.75 4.97A48 48 0 0 0 12 4.5c-2.291 0-4.545.16-6.75.47m13.5 0q1.515.215 3 .52m-3-.52l2.62 10.726c.122.499-.106 1.028-.589 1.202a6 6 0 0 1-2.031.352a6 6 0 0 1-2.031-.352c-.483-.174-.711-.703-.59-1.202zm-16.5.52q1.485-.305 3-.52m0 0l2.62 10.726c.122.499-.106 1.028-.589 1.202a6 6 0 0 1-2.031.352a6 6 0 0 1-2.031-.352c-.483-.174-.711-.703-.59-1.202z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":25},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M15.75 5.25a3 3 0 0 1 3 3m3 0a6 6 0 0 1-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1 1 21.75 8.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":27},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M7.864 4.243A7.5 7.5 0 0 1 19.5 10.5c0 2.92-.556 5.709-1.568 8.269M5.742 6.364A7.47 7.47 0 0 0 4.5 10.5a7.46 7.46 0 0 1-1.15 3.993m1.989 3.559A11.2 11.2 0 0 0 8.25 10.5a3.75 3.75 0 1 1 7.5 0q0 .79-.064 1.565M12 10.5a14.94 14.94 0 0 1-3.6 9.75m6.633-4.596a18.7 18.7 0 0 1-2.485 5.33\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":29},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M8.25 3v1.5M4.5 8.25H3m18 0h-1.5M4.5 12H3m18 0h-1.5m-15 3.75H3m18 0h-1.5M8.25 19.5V21M12 3v1.5m0 15V21m3.75-18v1.5m0 15V21m-9-1.5h10.5a2.25 2.25 0 0 0 2.25-2.25V6.75a2.25 2.25 0 0 0-2.25-2.25H6.75A2.25 2.25 0 0 0 4.5 6.75v10.5a2.25 2.25 0 0 0 2.25 2.25m.75-12h9v9h-9z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M19.5 14.25v-2.625a3.375 3.375 0 0 0-3.375-3.375h-1.5A1.125 1.125 0 0 1 13.5 7.125v-1.5a3.375 3.375 0 0 0-3.375-3.375H8.25m0 12.75h7.5m-7.5 3H12M10.5 2.25H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 0 0-9-9\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M12 9v3.75m0-10.036A11.96 11.96 0 0 1 3.598 6A12 12 0 0 0 3 9.75c0 5.592 3.824 10.29 9 11.622c5.176-1.332 9-6.03 9-11.622c0-1.31-.21-2.57-.598-3.75h-.152c-3.196 0-6.1-1.25-8.25-3.286m0 13.036h.008v.008H12z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M9 12.75L11.25 15L15 9.75m-3-7.036A11.96 11.96 0 0 1 3.598 6A12 12 0 0 0 3 9.749c0 5.592 3.824 10.29 9 11.623c5.176-1.332 9-6.03 9-11.622c0-1.31-.21-2.571-.598-3.751h-.152c-3.196 0-6.1-1.248-8.25-3.285\"\u002F>",{"id":37,"documentId":38,"title":39,"content":40,"slug":41,"published":42,"createdAt":43,"updatedAt":43,"publishedAt":44,"locale":45,"authorManual":46,"cover":47,"tags":89,"seo":114,"author":51},65,"amr6cqnto39er0jdr6jhmfmh","Multi-factor Authentication Login to AWS Management Console with YubiKey","\u003Cp>Logging in to the AWS Management Console supports \u003Cstrong>multi-factor authentication (MFA)\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>One-time passwords (TOTP) that can be used on smartphones such as Google Authenticator are often used, but \u003Cstrong>authentication devices such as YubiKey\u003C\u002Fstrong> can also be used.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Click here to purchase a YubiKey\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fykey.yubion.com\u002F\">Purchase from YubiKey Shop (Authorized Reseller)\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.amazon.co.jp\u002Fs?me=ADKPGBH0XPL04&marketplaceID=A1VC38T7YXB528\">Buy on Amazon\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>This article introduces \u003Cstrong>how to set up multi-factor authentication login to the AWS management console using YubiKey\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>Unlike one-time passwords, you don't have to worry about entering passwords, so I think this is more convenient to use.\u003C\u002Fp>\n\u003Cp>Previously, only one device could be set per user, but now it is possible to set multiple devices.\u003C\u002Fp>\n\u003Cp>AWS has changed its specification over time.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Any authentication device that supports FIDO can be used\u003C\u002Fstrong>. Currently, FIDO2 is the latest standard when it comes to FIDO, but AWS uses U2F (FIDO1 in a nutshell) function among FIDO. Therefore, slightly older FIDO keys such as YubiKey 4 can also be used.\u003C\u002Fp>\n\u003Cp>I would like it to support FIDO2 if possible.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Table of Contents\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"#viewer-a89bu\">\u003Cstrong>Prepare for Setting\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#viewer-3cr9k\">\u003Cstrong>Registration Setting Procedure\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#viewer-c7gg9\">\u003Cstrong>Login Confirmation Procedure\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#viewer-8bp2b\">\u003Cstrong>Register Other Authentication Devices\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#viewer-a3ajm\">\u003Cstrong>Summary\u003C\u002Fstrong>\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Now let's set up multi-factor authentication.\u003C\u002Fp>\n\u003Ch2>\u003Cstrong>Prepare for Setting\u003C\u002Fstrong>\u003C\u002Fh2>\n\u003Cp>Multi-factor authentication can be set by logging in to the AWS console and \u003Cstrong>setting it yourself\u003C\u002Fstrong>, or by \u003Cstrong>an administrator user setting for another user\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>This time, I will introduce the procedure to set it as an IAM user.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>To configure settings for another user, log in to the AWS console as a administrator user. Open "User" settings in "IAM", select target user, amd click "Muti-factor authentication (MFA)" in "Authentication information" to set up authentication device registration in the same way as in the article.\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>For the setting, the operating IAM user must have \u003Cstrong>permission to set up multi-factor authentication\u003C\u002Fstrong>. If you do not have the authority, set the authority in advance as necessary.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Permission to register for multi-factor authentication\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>iam:EnableMFADevice\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Permission to delete registered multi-factor authentication\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>iam:DeactivateMFADevice\u003C\u002Fp>\n\u003Ch2>\u003Cstrong>Registration Setting Procedure\u003C\u002Fstrong>\u003C\u002Fh2>\n\u003Cp>The following steps are performed in the following environment.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Browser:\u003C\u002Fstrong> Edge 109.0.1518.70\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Authentication Device:\u003C\u002Fstrong> YubiKey 5 NFC\u003C\u002Fp>\n\u003Cp>First, log in to the AWS console as usual.\u003C\u002Fp>\n\u003Cp>After logging in, click your name in the top right, then \u003Cstrong>click "Security credentials\u003C\u002Fstrong>".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_1_74d6a07b39.png\" alt=\"セキュリティ認証情報を選択\">\u003C\u002Fp>\n\u003Cp>Click the "\u003Cstrong>Assign MFA device\u003C\u002Fstrong>" button under "Multi-factor authentication (MFA)".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_2_0158c28cfc.png\" alt=\"MFAデバイスの割り当て設定\">\u003C\u002Fp>\n\u003Cp>Enter any device name, \u003Cstrong>select "Security Key\u003C\u002Fstrong>" and click "\u003Cstrong>Next\u003C\u002Fstrong>".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_3_316fdc4b83.png\" alt=\"MFAデバイスの設定\">\u003C\u002Fp>\n\u003Cp>Security key setup will start.\u003C\u002Fp>\n\u003Cp>Click "OK" to proceed.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_4_96c152c92e.png\" alt=\"セキュリティーキーのセットアップポップアップ\">\u003C\u002Fp>\n\u003Cp>Then click "OK".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_5_104b81510a.png\" alt=\"セットアップの続行ポップアップ\">\u003C\u002Fp>\n\u003Cp>If the YubiKey is not connected to USB, you will be prompted to do so.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_6_8c322fc95a.png\" alt=\"セキュリティキーの接続要求\">\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Connect your YubiKey to a USB port\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_7_adcd2147f6.jpeg\" alt=\"YubiKeyをUSBに接続\">\u003C\u002Fp>\n\u003Cp>After connecting the YubiKey, you will be prompted for a \u003Cstrong>PIN\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_8_d026389a4e.png\" alt=\"PINの入力\">\u003C\u002Fp>\n\u003Cpre>\u003Ccode>In the case of a fingerprint type authentication device, a fingerprint verification will be asked instead of PIN input.\nAlso, PIN input will not be displayed for FIDO authentication devices that do not support PIN or fingerprints(※).\n※ Slightly old devices that do not support FIDO2 (U2F only), such as YubiKey 4.\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>A message will appear asking you to touch your YubiKey.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_9_873fe2fefd.png\" alt=\"セキュリティキーのタッチ要求\">\u003C\u002Fp>\n\u003Cp>\u003Cstrong>The letter\u003C\u002Fstrong> "\u003Cstrong>Y\u003C\u002Fstrong>" \u003Cstrong>of the connected YubiKey will light up, so touch it\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_10_3e970d2fa7.jpeg\" alt=\"YubiKeyにタッチ\">\u003C\u002Fp>\n\u003Cp>登録が完了するとこのようなメッセージが表示されます。\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_11_3d0671bea7.png\" alt=\"登録完了メッセージ\">\u003C\u002Fp>\n\u003Cp>Looking at the contents, it seems that \u003Cstrong>up to 8\u003C\u002Fstrong> authentication devices can be registered.\u003C\u002Fp>\n\u003Cp>※ After registering a maximum of 8 devices, the "Assign MFA device" button will be disabled.\u003C\u002Fp>\n\u003Cp>The added key will be displayed in the list.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_12_ac598c615b.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>When I thought: "Where can I check the entered device name?", it was included in the "Identifier".\u003C\u002Fp>\n\u003Cp>The setting is completed.\u003C\u002Fp>\n\u003Cp>You will now have \u003Cstrong>multi-factor authentication on your next login\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Ch2>\u003Cstrong>Login Confirmation Procedure\u003C\u002Fstrong>\u003C\u002Fh2>\n\u003Cp>Sign out once, and try to use the YubiKey when logging in.\u003C\u002Fp>\n\u003Cp>Display the login screen of the AWS console.\u003C\u002Fp>\n\u003Cp>Enter your username and password to sign in.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_13_6c2a1bb7f5.png\" alt=\"追加の検証としてセキュリティキーのタッチ要求\">\u003C\u002Fp>\n\u003Cp>You will be asked to connect a security key as \u003Cstrong>additional verification\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_14_d786c07b1f.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>When you connect the YubiKey to USB, you will be asked to touch your key.\u003C\u002Fp>\n\u003Cp>You \u003Cstrong>will not be asked to enter a PIN\u003C\u002Fstrong> when logging in. It's how U2F works.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_15_e770f6937d.png\" alt=\"追加の検証としてセキュリティキーのタッチ要求\">\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Touch your YubiKey.\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_16_5bd15cbac5.jpeg\" alt=\"YubiKeyにタッチ\">\u003C\u002Fp>\n\u003Cp>If the authentication is successful, the console screen will open.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_17_b079913ceb.png\" alt=\"ログイン成功画面\">\u003C\u002Fp>\n\u003Cp>You were able to successfully \u003Cstrong>log in with multi-factor authentication using YubiKey\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Ch2>\u003Cstrong>Register Other Authentication Devices\u003C\u002Fstrong>\u003C\u002Fh2>\n\u003Cp>I used YubiKey5 NFC in the procedure, but you \u003Cstrong>can use any authentication device that supports FIDO\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>I will try to register with other authentication devices sold by our company.\u003C\u002Fp>\n\u003Ch4>YubiKey Bio (Yubico)\u003C\u002Fh4>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_18_81776c087b.jpeg\" alt=\"YubiKey Bio\">\u003C\u002Fp>\n\u003Cp>※ My YubiKey Bio is Type C, but I don't have a Type C connection port on my PC, so I used a USB adapter.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>YubiKey Bio\u003C\u002Fstrong> is a device that can perform FIDO2 biometric authentication (fingerprint).\u003C\u002Fp>\n\u003Ch4>Idem Key (GoTrust)\u003C\u002Fh4>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_19_cd8bb28fbc.jpeg\" alt=\"IdemKey\">\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Idem Key\u003C\u002Fstrong> is an authentication device that sets a FIDO2 PIN, just like YubiKey5 NFC.\u003C\u002Fp>\n\u003Ch4>ATKey.Pro (AUTHENTREND)\u003C\u002Fh4>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_20_4e98084a94.jpeg\" alt=\"ATKey.Pro\">\u003C\u002Fp>\n\u003Ch4>\u003C\u002Fh4>\n\u003Ch4>\u003C\u002Fh4>\n\u003Ch4>\u003C\u002Fh4>\n\u003Ch4>\u003C\u002Fh4>\n\u003Ch4>\u003C\u002Fh4>\n\u003Ch4>\u003C\u002Fh4>\n\u003Ch4>\u003C\u002Fh4>\n\u003Ch4>\u003C\u002Fh4>\n\u003Cp>\u003Cstrong>ATKey.Pro\u003C\u002Fstrong> is an authentication device that can perform FIDO2 biometric authentication (fingerprint).\u003C\u002Fp>\n\u003Ch4>\u003C\u002Fh4>\n\u003Ch4>YubiKey4 (Yubico)\u003C\u002Fh4>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_21_b352f35f8b.jpeg\" alt=\"YubiKey4\">\u003C\u002Fp>\n\u003Cp>\u003Cstrong>YubiKey4\u003C\u002Fstrong> is a U2F device. ※ Currently not available.\u003C\u002Fp>\n\u003Cp>All of these authentication devices \u003Cstrong>could be used\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>From here on, it's a small story level, but the operation at the time of registration and authentication differs slightly depending on the device.\u003C\u002Fp>\n\u003Cp>The authentication devices tested this time can be divided into the following types:\u003C\u002Fp>\n\u003Cp>\u003Cstrong>FIDO2 (PIN)\u003C\u002Fstrong> …YubiKey5 NFC, Idem Key, etc.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>FIDO2 (biometric authentication)\u003C\u002Fstrong> …YubiKey Bio, ATKey.Pro, etc.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>FIDO U2F\u003C\u002Fstrong> …YubiKey4, etc.\u003C\u002Fp>\n\u003Cp>And the behavior for each type is as follows:\u003C\u002Fp>\n\u003Cp>\u003Cstrong>At registration:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>FIDO2 (PIN): Touch after entering a PIN\u003C\u002Fp>\n\u003Cp>FIDO2 (biometric authentication): biometric check + touch\u003C\u002Fp>\n\u003Cp>FIDO U2F: touch only\u003C\u002Fp>\n\u003Cp>\u003Cstrong>At authentication:\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>FIDO2 (PIN): touch only\u003C\u002Fp>\n\u003Cp>FIDO2 (biometric authentication): biometric check + touch\u003C\u002Fp>\n\u003Cp>FIDO U2F: touch only\u003C\u002Fp>\n\u003Cp>Since the implementation on the AWS side is U2F, if the authentication device used is FIDO2, the behavior seems to change little by little.\u003C\u002Fp>\n\u003Ch2>\u003Cstrong>Summary\u003C\u002Fstrong>\u003C\u002Fh2>\n\u003Cp>By setting up multi-factor authentication using YubiKey, you can log in \u003Cstrong>more securely and easily\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>As I wrote at the beginning, the one-time password (TOTP) is convenient because it can be used with a smartphone. But as the number of IDs to be used increases, it becomes difficult just to search for the right ID. And it is surprisingly troublesome to enter the TOTP each time. So authentication devices are more convenient to use, right?\u003C\u002Fp>\n\u003Cp>From the point of view of management, it is also easy to manage, since all you have to do is manage physical devices.\u003C\u002Fp>\n\u003Cp>If your company doesn't have company-issued smartphones, it's uneasy to put one-time password information on your smartphone from a security perspective. But if it's a physical device, it's possible to hand over the device to the user only when necessary.\u003C\u002Fp>\n\u003Cp>If you have a FIDO authentication device such as YubiKey, why not give it a try?\u003C\u002Fp>\n\u003Cp>You can purchase YubiKeys and other authentication devices we sell from the following sites.\u003C\u002Fp>\n\u003Cp>For a quote, please contact us using the inquiry form.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>YubiKey Shop (Authorized Reseller)\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fykey.yubion.com\u002F\">https:\u002F\u002Fykey.yubion.com\u002F\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Amazon\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.amazon.co.jp\u002Fs?me=ADKPGBH0XPL04&marketplaceID=A1VC38T7YXB528\">https:\u002F\u002Fwww.amazon.co.jp\u002Fs?me=ADKPGBH0XPL04&marketplaceID=A1VC38T7YXB528\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Contact\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.yubion.com\u002Fcontact-form\">https:\u002F\u002Fwww.yubion.com\u002Fcontact-form\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>Thank you for reading to the end.\u003C\u002Fp>\n","aws-mfa-login-with-yubikey","2022-12-21","2026-04-28T06:46:57.334Z","2026-04-28T06:47:00.614Z","en","YubiOnstaff",{"id":48,"documentId":49,"name":50,"alternativeText":51,"caption":51,"focalPoint":51,"width":52,"height":53,"formats":54,"hash":84,"ext":56,"mime":60,"size":85,"url":86,"previewUrl":51,"provider":87,"provider_metadata":51,"createdAt":88,"updatedAt":88,"publishedAt":88},618,"z6x9jby29zdkc7glu1ypppi3","blog-aws-mfa-login-with-yubikey-1.png",null,866,958,{"small":55,"medium":66,"thumbnail":75},{"ext":56,"url":57,"etag":58,"hash":59,"mime":60,"name":61,"path":51,"size":62,"width":63,"height":64,"sizeInBytes":65},".png","https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fsmall_blog_aws_mfa_login_with_yubikey_1_74d6a07b39.png","7b659bbb7d6322f501aa493057937e44","small_blog_aws_mfa_login_with_yubikey_1_74d6a07b39","image\u002Fpng","small_blog-aws-mfa-login-with-yubikey-1.png",62.66,452,500,62664,{"ext":56,"url":67,"etag":68,"hash":69,"mime":60,"name":70,"path":51,"size":71,"width":72,"height":73,"sizeInBytes":74},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fmedium_blog_aws_mfa_login_with_yubikey_1_74d6a07b39.png","d31a24a67492d197b1242c69ab3d6eec","medium_blog_aws_mfa_login_with_yubikey_1_74d6a07b39","medium_blog-aws-mfa-login-with-yubikey-1.png",113.28,678,750,113279,{"ext":56,"url":76,"etag":77,"hash":78,"mime":60,"name":79,"path":51,"size":80,"width":81,"height":82,"sizeInBytes":83},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fthumbnail_blog_aws_mfa_login_with_yubikey_1_74d6a07b39.png","8011911071c31b6c471504f5e5a85d64","thumbnail_blog_aws_mfa_login_with_yubikey_1_74d6a07b39","thumbnail_blog-aws-mfa-login-with-yubikey-1.png",11.92,141,156,11919,"blog_aws_mfa_login_with_yubikey_1_74d6a07b39",28.11,"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aws_mfa_login_with_yubikey_1_74d6a07b39.png","aws-s3","2026-04-28T06:45:04.869Z",[90,96,102,108],{"id":91,"documentId":92,"name":93,"slug":51,"createdAt":94,"updatedAt":94,"publishedAt":95},12,"aire52m2y26x0uq2lb8m0nwy","FIDO","2026-04-28T01:49:06.707Z","2026-04-28T01:49:08.676Z",{"id":97,"documentId":98,"name":99,"slug":51,"createdAt":100,"updatedAt":100,"publishedAt":101},28,"ctdhuf8ybynihdblggcicfqi","SecurityKey","2026-04-28T05:16:07.443Z","2026-04-28T05:16:09.282Z",{"id":103,"documentId":104,"name":105,"slug":51,"createdAt":106,"updatedAt":106,"publishedAt":107},90,"n9u5mo7asrxetrc7s5uptn6z","AWS","2026-04-28T06:16:19.352Z","2026-04-28T06:16:21.281Z",{"id":109,"documentId":110,"name":111,"slug":51,"createdAt":112,"updatedAt":112,"publishedAt":113},102,"uqbg02l5gzj5wkl3gqtns0wx","SettingGuide","2026-04-28T06:46:52.463Z","2026-04-28T06:46:54.313Z",{"id":115,"metaDescription":116},299,"Learn how to set up multi-factor authentication (MFA) for the AWS Management Console using a YubiKey for secure, easy login.",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":118},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M15.75 6a3.75 3.75 0 1 1-7.5 0a3.75 3.75 0 0 1 7.5 0M4.501 20.118a7.5 7.5 0 0 1 14.998 0A17.9 17.9 0 0 1 12 21.75c-2.676 0-5.216-.584-7.499-1.632\"\u002F>",1783406263801]