AWS Cloud Security

Protect Yourself Online with a Free Multi-Factor Authentication Key

Increase the security of your business and personal information online with MFA

How to Get Your Free MFA Security Key

1

Visit the MFA Ordering Portal & log in

Once you visit the MFA ordering site, your eligibility for the offer will be verified

MFA Ordering Portal

2

Select your MFA security key

Choose which MFA security key best suits your needs from the options provided

3

Checkout

Enter in your name and shipping details, and complete your order!

Security is our top priority

Security is our top priority, and we’re always looking for new ways to help our customers improve their security posture. That’s why we are offering qualified customers a free multi-factor authentication (MFA) security key designed to further protect their environments and protect their assets. In addition, we began offering our security training materials—originally developed by AWS for Amazon employees—to individuals and organizations to help keep them and their sensitive information safe. Read our blog post and press release to learn more.

AWS Multi-Factor Authentication

For highly sensitive information, such as personal documents, proprietary customer information, and companies’ technology infrastructure assets, stronger tools are recommended to protect data. Designed to augment your security plan and protect your most sensitive assets, the free MFA security key adds an additional layer of security to protect you online. You will be able to use your MFA security key to safely access multiple AWS accounts, as well as other key-enabled applications.

Benefits of MFA

Safer internet for all

MFA creates a safer internet where there is less identity theft and breaches.

Virtually un-phishable

Security keys are superior because they are virtually un-phishable. They are also more durable than the alternative virtual option, though any MFA is good MFA.

Easy to use

MFA is an easy way to up-level safety online. Rather than typing in a sequence of numbers generated from a physical device, you just plug in the MFA security key and tap when done.

Compatible with popular websites

MFA is supported by today’s most popular business and consumer websites, so your security key will come in handy for virtually anything you do online.

Page topics

FAQs
15

FAQs

Open all

I can’t access the ordering portal, but I meet the spend requirements. How can I get access?

Recent updates to IAM permission may have blocked your access to the free MFA security key ordering site. In order to address this, you will need to set the proper AWS Identity and Access Management (IAM) permissions. Add the following IAM policy to your user profile: mfa-token-portal:*

For steps on how to add IAM identity permissions, see: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html

If you want to list out the individual actions instead, then you must include all the actions. Otherwise, the ordering site won’t work correctly. For example:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Action": [

"mfa-token-portal:GetMfaDevices",

"mfa-token-portal:CheckEligibility",

"mfa-token-portal:CreateOrder",

"mfa-token-portal:PrepareOrder",

"mfa-token-portal:UnlinkAccounts"

]

"Resource": "*"

{

"Effect": "Allow",

"Action": "securityhub:DescribeHub",

"Resource": "*"

}

]

}

Who is eligible to receive free MFA security keys?

At this time, US-based root account holders who have spent $300 or more over the past 3 months, are eligible to receive a free MFA security key. Payer accounts that meet the same spend threshold, are also eligible.

What is a root account holder?

When you first create an Amazon Web Services (AWS) account, you begin with one identity that has complete access to all AWS services and resources in the account. This identity is called the AWS account root user. You can sign in as the root user using the email address and password that you used to create the account. You can find more information about root account holders.

I’m a payer account would like their linked accounts to order for themselves. How do they do that?

If you are a Payer account that is eligible for this offer, you will see an option when visiting the ordering portal to give ordering access for all your linked accounts. You will be prompted to click on the “Transfer ordering access to linked accounts” option, allowing your linked accounts to order their own key. Note that once you enable this option, it can’t be revoked.

By default, why can’t linked accounts place orders?

In response to customer feedback, we enabled Payer accounts with the authority to enable linked accounts to place their own orders, or to place bulk orders on behalf of their linked accounts. This allows the payer to choose the path that is more convenient for their organization’s needs.

I’m a payer account and I would like to place a bulk order on behalf of my eligible linked accounts to obtain their MFA security keys. How do I do this?

If you are an eligible payer account, you will see a section on the ordering portal homepage that says “Eligible key quantity.” If you choose to place a bulk order for your linked accounts, you can manage that option from this section.

If I am not eligible for a free security key, is there another way I can acquire one?

You can review which security key is appropriate for your needs on the IAM Multi-factor authentication page and purchase on Amazon.com.

How do I setup my MFA security key?

We offer guidance for setup of your MFA security key. You may also reference instructions directly from the MFA security key provider.

Security Key NFC by Yubico setup instructions

Once ordered, when will my security key ship?

Please allow up to 10 business days from “order received” notification for processing. You will receive an email with shipping details once you’ve placed your order.

It’s been 10 days since I ordered my security key. Where is it?

If you haven’t received an update or physical key by this time, please contact customer service by submitting a request under billing or account support.

I have a broken/lost security key, how do I replace it?

View our guidance on what to do if you have a broken or lost security key. If you still have questions, please contact customer service by submitting a request under billing or account support.

How do I know if I qualify to receive an MFA security key?

Determine if you are eligible to receive a token. If you are eligible, you will be prompted to order your free security key.

What types of security keys are available?

Currently, we offer customers the option of the Security Key NFC by Yubico.

What else can I do to improve my security posture in AWS?

AWS offers comprehensive security services to help you improve your security posture. As a first step, we recommend that you turn on AWS Security Hub and its Foundational Security Best Practices standard, which are automated checks that evaluate your security posture in AWS.

Where can I go to find more information about cloud security on AWS?

We recommend reading the below materials to learn more about cloud security on AWS:

Visit our Security, Identity and Compliance services page to learn about services you can start using today
Learn about 10 things you can do to improve your security account from Amazon CSO, Steve Schmidt
Read the AWS Well Architected Framework - Security Pillar
Read the AWS Security Reference Architecture
Read the AWS Security Blog and subscribe to the AWS Security Twitter account for security news and updates about our services
Explore AWS security partner and Marketplace solutions.