Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a bit unclear about the AWS MFA...

I have a website on EC2 which is restricted in the security group to the IP addresses of our clients. Our clients would like to have some way of accessing the site when they're on the road, and I'm wondering if I can use an MFA / IAM role to grant them access.

I don't want to grant them access to logging into the aws console, which is what I understand IAM is all about.

I would like to create a role that will allow access to a specific port on my EC2 client (i.e. ports 80 and 443) when they log in with some sort of MFA... am I wasting my time digging through the MFA documentation to figure this out, or is this possible?

Or is there an alternative way of doing this (such as giving them an SSH key, and writing an SSH app that authenticates an IP address, and just leaving port 22 open to the world?)

share|improve this question
up vote 3 down vote accepted

MFA is only used for access to the AWS console and APIs, not network traffic to instances. You need a VPN to achieve what you want.

share|improve this answer
Thanks - that's exactly what I wanted to know! – Adam Morris Jul 12 '12 at 10:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.