shonindocs

Use AWS

Second factor

Shonin asks for a second factor when you sign in. Your installation checks it, in your AWS account. Once verified, the console, Access keys and the command line do not ask again for 8 hours.

#Authenticator app

In Personal settings (next to your name, at the top of every page), Authenticator app shows whether you have one and when you set it up.

  • Set up an authenticator app: use an app like Google Authenticator, Microsoft Authenticator or 1Password. Shonin shows a QR code; Show secret key shows the key to type instead. Enter a code from the app to continue.
  • Replace the app (a new phone, for example): Shonin first asks for a code of your current app or a backup code. Nothing changes until you enter the first code of the new app; then the old app and the old backup codes stop working.

Then Shonin shows 10 backup codes, after you choose Show. Each works once, if you lose your phone: keep them somewhere safe, Shonin cannot show them again.

  • Primary admins must set up an authenticator app at their first sign-in.
  • The management account of your AWS organization accepts only a code from the app or a backup code.
  • After 100 wrong codes in a row the app is locked.

#Code by email

People without an authenticator app get a 6-digit code by email. It is valid 10 minutes, and 5 wrong codes stop it. Once you set up an app, codes by email stop: Shonin delivers the emails, and the app does not depend on it.

#More AWS organizations

When your Shonin org has more than one AWS organization, one installation checks the second factor and keeps everyone's authenticator app; the installations of the other AWS organizations accept what it checked. It is the first one you connected.

A primary admin can check it in another installation: in Org settings, panel Second factor, choose the installation in Check it in, enter a code from the app or a backup code, and choose Move the second factor. The authenticator apps move to that installation, encrypted for it only, and the previous one deletes them. Everyone keeps their app and backup codes, and every primary admin gets an email.

#Primary admins

Primary admins sign in with a password and an authenticator app, also with single sign-on on, so the Shonin org stays reachable if your identity provider is unavailable. Only a primary admin makes or removes another primary admin, in Org settings, and a Shonin org always keeps at least one.

View as Markdown