As of today, Amazon customers can activate WebAuthn in AWS Single Sign-On as additional multi-factor authentication. So far, the service only offered one-time passwords (OTP) and radius for this.

WebAuthn has been developed by the FIDO Alliance and the W3C since 2019 Version 1.0 published web standard for passwordless authentication with public key procedures. It is also a core component of FIDO-2, which is used in many security keys and in current operating systems such as Android, Linux or Windows. The service on the server uses the Client-to-Authenticator Protocol (CTAP) to access a local authenticator, such as a fingerprint scanner, integrated facial recognition or a hardware token.

MFA can be set up with just a few settings via the WebAuthn authenticator.

(Image: Amazon AWS)

Users can register various authentication devices via the WebAuthn authenticator and in the future use one of them to log into the AWS Management Console or the AWS Command Line Interface (CLI). The two-factor authentication from WebAuthn not only works for all identities stored in the internal identity store of AWS Single Sign-On, but also for users from an Active Directory – regardless of whether they are managed by AWS or not. All information and instructions for configuration can be found in the associated blog entry.

(avr)