Skip to content
Novaz AuthenticatorGET

AWS 2FA: how to set up an authenticator app for root and IAM users

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on MFA for the root user
  2. Turn on MFA for an IAM user
  3. No backup codes: register a second device
  4. If AWS rejects your code
  5. Changing phones or removing a device
  6. If you lose your authenticator
  7. Signing in through the AWS access portal
  8. Official AWS help

An AWS account has two kinds of console sign-in: the root user, which is the email address and password that opened the account (AWS), and IAM users, separate sign-ins with their own MFA settings (AWS). Multi-factor authentication (MFA) is mandatory for the root user on every account type: you get 35 days from your first sign-in attempt to register a device (AWS). For IAM users, it's up to the account's administrator.

AWS accepts passkeys and security keys, which it recommends, plus authenticator apps (virtual MFA devices, in AWS terms) and hardware tokens. Text-message MFA can no longer be turned on (AWS). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the AWS steps come from AWS's own documentation and Knowledge Center articles, linked below, which we read on October 20, 2026. We haven't tested them on an AWS account. AWS's pages don't all use the same labels, so what you see may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on MFA for the root user

First, check that you can still reach the account's email address and primary contact phone. They're the root user's way back in if you lose the authenticator (AWS). Then follow AWS's steps (AWS):

  1. Sign in to the console as Root user with the account's email address and password.
  2. On the right of the navigation bar, choose your account name, then Security credentials.
  3. In the Multi-Factor Authentication (MFA) section, choose Assign MFA device.
  4. Type a Device name, choose Authenticator app, then Next.
  5. Choose Show QR code. In Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
  6. If you can't scan it, choose Show secret key. In Novaz, tap +, then Enter key manually, and type it as the Setup key. AWS codes are 6 digits and change every 30 seconds, so a typed key works. See What is a 2FA setup key?
  7. Type the current Novaz code in MFA code 1. Wait for the next code, type it in MFA code 2, and choose Add MFA.

Do step 7 straight away, or the device is saved out of sync and needs a resync (below). From then on, AWS asks for a code at every console sign-in, after your password. AWS's pages don't mention trusted devices (AWS).

Turn on MFA for an IAM user

For your own IAM user, if your administrator allows it, choose your user name at the top right, then Security credentials, then Assign MFA device, and follow the same wizard. One AWS tutorial shows a single code box and Register MFA instead (AWS).

An administrator can do it in the IAM console under Users, the user's name, then the Security Credentials tab, but needs that person's phone in hand (AWS).

No backup codes: register a second device

AWS's pages mention no backup codes. Instead, each root user and IAM user can register up to eight MFA devices of any type, and any one signs you in (AWS). AWS recommends an authenticator app's cloud backup (AWS). In Novaz that's iCloud backup (PRO) under Settings › Backup, where you can also export a backup file. A second device is still worth adding, such as a passkey, a security key, or an authenticator on another device.

AWS's root user page also suggests a secure copy of the QR code or secret key, which can set up a replacement later (AWS). If you keep one, guard it like the root password.

If AWS rejects your code

AWS says an authenticator can drift out of sync. After failed sign-ins, it asks you to resync by typing two codes in a row into MFA code 1 and MFA code 2. You can also select the device under Security credentials and choose Resync (AWS).

On an iPhone, the usual cause is the clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. More in Authenticator code not working?

Changing phones or removing a device

Add the new phone as an extra MFA device first. Then, under Security credentials, select the old one and choose Remove twice. AWS emails the root user a confirmation (AWS). IAM users need an existing device to add or remove one (AWS). The root user must always keep one.

If you restore Novaz on the new iPhone from iCloud backup or a backup file, its codes keep working and you don't need to add the new phone as a device. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

If you have another registered device, choose Try another MFA method at sign-in. Without one (AWS):

  • Root user: choose Troubleshoot MFA, then Sign in using alternative factors. Verify the email with Send verification email, then the phone with Call me now: type the 6-digit number shown on screen on your phone's keypad. Once in, delete the old device under Security credentials and add a new one. If the phone was stolen, change the root password too.
  • No access to that email or phone: use AWS Support's Lost or unusable MFA device form. If only the phone number is outdated, an IAM user with administrator access can update it (AWS). AWS doesn't say how long recovery takes.
  • IAM user: ask your administrator to remove the device. AWS is clear that "Support can't assist IAM users with MFA device issues" (AWS).

More in Lost the phone with your authenticator app?

Signing in through the AWS access portal

IAM Identity Center has its own MFA: in the AWS access portal, choose MFA devices, then Register device, within rules your administrator sets (AWS).

Official AWS help

More guides: Hosting and cloud