Hacker News Reader

Comment by aamoscodes | Hacker News Reader

My personal issue right now is that I have multiple accounts with MFA and there’s no easy way to differentiate them besides this generated account ID in the auth app. This means I have to create some type of mapping table between the ID and the account, or try to remember what’s available

View on HN

We have a very funny situation in our org, where AWS auth is setup using our MS domain, with app push-based MFA. However, the AWS MFA workflow seems to not know about push based notifications, so it asks for a verification code which can literally be anything. After you provide some code and click Verify, only then does it send the push notification, and the UI just freezes until you either accept the auth request or some timeout happens.

Not to mention, we actually have to provide the Domain password in the AWS UI, which seems to go against any kind of security I know...

If you already have an MS domain you could set up SAML login with ADFS (tried this, works fairly well) or AWS SSO if you have a managed AD in AWS (may not be available in your region). Also works very well with AzureAD as the provider, if you use that synced to your on-prem AD.

Every MFA app I've used has the ability to rename the entry, since the MFA key and the text that are displayed to the user are 100% unrelated to one another. And I recognize that you might not have the correct privilege level to carry it out, but AWS does allow you to create account aliases, which helpfully shows up in the console login URL

Exactly what I was about to say. For reference account aliases are documented at: https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-...

Can't you just use an account alias?

https://docs.aws.amazon.com/IAM/latest/UserGuide/console_acc...

Reply on news.ycombinator.com