AWS Solutions Architect · Lesson

IAM Best Practices and MFA

Enable MFA, rotate access keys, use the IAM credential report, and review common IAM misconfigurations caught in audits.

IAM Best Practices and MFA is a free AWS Solutions Architect lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS Solutions Architect learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

IAM Best Practices Overview

AWS has an official IAM checklist that shows up all over the exam: lock away root, turn on MFA, use roles over keys, grant least privilege, and rotate credentials.

Lock Away the Root User

The root user can't be limited by any policy, so secure it hard: enable MFA, delete its access keys, and use it only for the rare tasks that demand it.

# Check if root account has MFA enabled (from Security Hub or Trusted Advisor)
aws securityhub get-findings \
  --filters '{"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}],"Title":[{"Value":"MFA should be enabled for the root account","Comparison":"CONTAINS"}]}' \
  --query 'Findings[].Title'

Multi-Factor Authentication (MFA)

MFA adds a second proof on top of your password — a code from an app or a key fob. Turn it on for every human user, especially admins.

# Enable a virtual MFA device for a user
aws iam enable-mfa-device \
  --user-name alice \
  --serial-number arn:aws:iam::123456789012:mfa/alice \
  --authentication-code1 123456 \
  --authentication-code2 789012

MFA Device Types

AWS supports four MFA device types: authenticator apps, hardware fobs, FIDO security keys (the gold standard), and SMS (the weakest — avoid for admins).

Rotating Access Keys

Long-term keys never expire, so rotate access keys about every 90 days. Two keys are allowed at once, so you can swap with zero downtime.

# Step 1: Create new access key
aws iam create-access-key --user-name alice

# Step 2: After updating all apps to new key, deactivate old key
aws iam update-access-key \
  --user-name alice \
  --access-key-id AKIAIOSFODNN7EXAMPLE \
  --status Inactive

# Step 3: Delete old key
aws iam delete-access-key \
  --user-name alice \
  --access-key-id AKIAIOSFODNN7EXAMPLE

IAM Credential Report

The IAM credential report is a CSV listing every user's password age, key rotation, and MFA status. Pull it monthly to catch stale or risky credentials.

# Generate and download the credential report
aws iam generate-credential-report
aws iam get-credential-report \
  --query 'Content' \
  --output text | base64 --decode > iam-credential-report.csv

Prefer Roles Over Long-Term Keys for Applications

For anything running on AWS — EC2, Lambda, ECS — use IAM roles, not long-term keys. Roles refresh credentials automatically and keep them out of your code.

IAM Password Policy

Set an account password policy to force strong console passwords: a solid minimum length, mixed characters, regular expiry, and no reusing old ones.

# Set a strong password policy
aws iam update-account-password-policy \
  --minimum-password-length 14 \
  --require-uppercase-characters \
  --require-lowercase-characters \
  --require-numbers \
  --require-symbols \
  --max-password-age 90 \
  --password-reuse-prevention 5

Use Separate Accounts for Isolation

The strongest isolation is using separate accounts for prod and dev. A bad policy in dev can't touch prod when they live in different accounts.

Monitoring IAM Activity with CloudTrail

Every IAM action is logged in CloudTrail. Add alarms for things like root logins or policy changes, and you've got an early warning system for misuse.

# Create a CloudWatch metric filter for root account usage
aws logs put-metric-filter \
  --log-group-name CloudTrail/MainTrail \
  --filter-name RootAccountUsage \
  --filter-pattern '{$.userIdentity.type="Root"}' \
  --metric-transformations metricName=RootAccountUsageCount,metricNamespace=IAMSecurity,metricValue=1

AWS Trusted Advisor IAM Checks

Trusted Advisor runs quick security checks: it flags root accounts without MFA, root access keys, and even keys leaked in public code repos.

Quick Check

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

Lesson Recap

Quick recap: secure root with MFA, rotate keys and prefer roles, and use the credential report, CloudTrail, and Trusted Advisor to watch IAM. Next up: EC2 essentials.

Frequently asked questions

Is the “IAM Best Practices and MFA” lesson free?

Yes — the full text of “IAM Best Practices and MFA” is free to read here on the web, and the AWS Solutions Architect course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS Solutions Architect course, upgrade to CoddyKit PRO.

What will I learn in “IAM Best Practices and MFA”?

Enable MFA, rotate access keys, use the IAM credential report, and review common IAM misconfigurations caught in audits. You practise AWS Solutions Architect with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start AWS Solutions Architect?

No prior experience is required. AWS Solutions Architect on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “IAM Best Practices and MFA” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this AWS Solutions Architect lesson?

Yes. Every AWS Solutions Architect lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to AWS Solutions Architect