• If you are root/admin account, in order to configure a virtual MFA device, you must have physical access to the device.For example, if you are configuring MFA for a user who will use a smartphone to generate an OTP, you must have the smartphone available in order to finish the wizard. Because of this, you might want to let them configure the devices themselves. If the following policy is attached to a user or to a group that the user is in, the user can manage configure and manage his or her own virtual MFA device using the AWS Management Console.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowUsersToCreateDeleteTheirOwnVirtualMFADevices",
      "Effect": "Allow",
      "Action": ["iam:*VirtualMFADevice"],
      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:mfa/${aws:username}"]
    },
    {
      "Sid": "AllowUsersToEnableSyncDisableTheirOwnMFADevices",
      "Effect": "Allow",
      "Action": [
        "iam:DeactivateMFADevice",
        "iam:EnableMFADevice",
        "iam:ListMFADevices",
        "iam:ResyncMFADevice"
      ],
      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/${aws:username}"]
    },
    {
      "Sid": "AllowUsersToListVirtualMFADevices",
      "Effect": "Allow",
      "Action": ["iam:ListVirtualMFADevices"],
      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:mfa/*"]
    },
    {
      "Sid": "AllowUsersToListUsersInConsole",
      "Effect": "Allow",
      "Action": ["iam:ListUsers"],
      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/*"]
    }
  ]
}

1. You can use a specific name such as "David" to replace ${aws:username}, then this policy is attached to user David. As with the policies for accessing user-specific Amazon object, you‘d have to create a separate policy for each user that includes the user‘s name, and then attach each policy to the individual users.
   
2. When you use a policy variable (${aws:username}) for the user name like this, you don‘t have to have a separate policy for each individual user. Instead, you can attach this new policy to an IAM group that includes everyone who should be allowed to manage their own access keys. When a user makes a request to modify his or her access key, IAM substitutes the user name from the current request for the ${aws:username} variable and evaluates the policy.
   

• To configure and enable a virtual MFA device for a user
  • Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
  • In the navigation pane, click User and then select the user you want to enable the virtual MFA for.
  • In the user details pane, select Security Credentials, and then click Manage MFA Device.
  • In the Manage MFA Device wizard, select A virtual MFA device and then click Continue.
  • Confirm that a virtual MFA application is installed on the user‘s mobile device and then click Continue. (For a list of apps that you can use as virtual MFA devices, see Multi-Factor Authentication.) IAM generates and displays configuration information for the virtual MFA device, including a QR code similar to the following graphic.
  • With the Manage MFA Device wizard still open, open the virtual MFA application on the device. If the device supports QR codes, the easiest way to configure the application is to use the application to scan the QR code. If you cannot scan the code, you can enter the secret configuration key manually.
    • To use the QR code to configure the virtual MFA device, follow the app instructions for scanning the code. For example, you might need to tap the camera icon or tap a command like Scan account barcode, and then use the device‘s camera to scan the code.
    • If you cannot scan the code, enter the configuration information manually by typing the Secret Configuration Key value into the application. For example, to do this in the AWS Virtual MFA application, tapManually add account, and then type the secret configuration key and click Create.
    • NoteThe QR code and secret configuration key are unique and cannot be reused.
  • When you are finished configuring the device, the device starts generating six-digit numbers.
  • In the IAM Manage MFA Device wizard, in the Authentication Code 1 box, type the six-digit number that‘s currently displayed by the MFA device. Wait 30 seconds for the device to generate a new number, and then type the new six-digit number into the Authentication Code 2 box.Click Continue.