AWS IAM: Lost MFA Device - Complete Recovery Guide

If you've lost your AWS MFA device, you're locked out of your account—but recovery is possible. For the root user, you can reset it via the AWS Console using your registered email and phone number. For an IAM user, you must contact an administrator with permission to deactivate your MFA device. If you're the only admin and locked out, you'll need to contact AWS Support with notarized documents proving ownership. This guide covers every scenario, from prevention to full account recovery.

Root User vs. IAM User: Critical Differences

The recovery process depends entirely on your user type. The root user has ultimate privileges and can use self-service recovery, while IAM users are dependent on an administrator.

Root User Recovery: Step-by-Step Process

Scenario 1: You Have Access to Root Email/Phone

If you can access the email address and phone number associated with your root account, you can reset your MFA device via the AWS Management Console.

1. Navigate to the AWS sign-in page and enter your root user email address.
2. On the password sign-in page, click "Forgot password?" and follow the password reset instructions.
3. After resetting your password, you'll be prompted to set up a new MFA device during the sign-in process.
4. Follow the console prompts to deactivate the old MFA device and activate a new one.

Scenario 2: You've Lost Access to Root Email/Phone

If you can't access the registered email or phone number, you'll need to contact AWS Support for assistance.

1. Go to the AWS Support Center and create a case.
2. Explain your situation: you've lost your MFA device and no longer have access to the root email/phone.
3. Provide required documentation: AWS may request notarized documents proving your identity and ownership of the account.
4. Cooperate with verification: AWS will verify your identity and ownership before resetting your MFA.

IAM User Recovery: Administrator's Guide

If you're an IAM user who lost their MFA device, you cannot reset it yourself—you must contact an administrator with appropriate permissions.

For Administrators: Deactivating a User's MFA Device

As an administrator, you can deactivate an IAM user's MFA device using the AWS Console or CLI.

1. Sign in to the AWS Console as an administrator with IAM permissions.
2. Navigate to IAM > Users and select the affected user.
3. Choose the "Security credentials" tab.
4. Find the MFA device section and click "Manage" next to the MFA device.
5. Select "Deactivate" and confirm the action.

Alternatively, use the AWS CLI:

aws iam deactivate-mfa-device \
  --user-name  \
  --serial-number 

For IAM Users: Requesting MFA Reset

As an IAM user, you should:

1. Contact your administrator via internal channels (helpdesk, email, etc.).
2. Provide your username and explain you've lost your MFA device.
3. Request MFA deactivation so you can set up a new device.

Complete Lockout: When You're the Only Admin

If you're the only administrator and have lost both your MFA device and access to the root email/phone, you're in a serious situation. Here's what to expect:

The AWS Support Process

AWS has a specific process for this scenario, designed to verify account ownership while preventing unauthorized access.

1. File a support case through the AWS Support Center (you'll need to create a new AWS account to do this if you can't access your existing one).
2. Clearly explain your situation: you're the sole admin locked out due to lost MFA and no access to recovery methods.
3. Prepare documentation: AWS will request notarized documents to verify your identity and association with the account.
4. Cooperate with verification: This may include providing government ID, business registration documents, or other proof.

Real-World Experience

From community reports, the process typically requires:

• Notarized documents proving your identity (e.g., notarized copy of your government ID).
• Proof of business ownership (if it's a company account).
• Patience: the verification process isn't fast.

Recovery Flowchart: Which Path Are You On?

Use this decision tree to determine your recovery path:

Troubleshooting Common MFA Issues

Issue: MFA Code Not Working

If your MFA device is generating codes but AWS rejects them:

1. Check time synchronization: Ensure your device's clock is synced with network time. MFA codes are time-based and expire quickly.
2. Wait for a new code: Generate a fresh code and try again. Some devices have a delay.
3. Verify device serial number: Ensure you're entering codes from the correct MFA device.

Issue: "MFA Device Already Exists" Error

If you're trying to activate a new MFA device and get this error:

1. Check for existing MFA devices: Use the AWS CLI to list virtual MFA devices:

   aws iam list-virtual-mfa-devices

2. Deactivate the old MFA device first (if you have access).
3. If locked out, you'll need to go through the recovery process.

Issue: CLI Command Doesn't Show MFA Devices

If aws iam list-mfa-devices returns nothing for the root user:

• This is by design—the command lists MFA devices for IAM users, not the root user.
• Use aws iam list-virtual-mfa-devices instead to see root user MFA devices.

Prevention: Best Practices to Avoid Lockouts

Frequently Asked Questions

1. How do I reset my AWS root user MFA if I've lost my device?

Use the AWS Console sign-in page with your root email. Follow the "Forgot MFA device?" link and verify via email/phone. If you've lost those too, contact AWS Support with notarized documents.

2. Can an IAM user reset their own MFA device?

No. IAM users must contact an administrator to deactivate their old MFA device before setting up a new one.

3. What documents does AWS require for MFA recovery?

AWS typically requires notarized documents proving your identity and account ownership. This may include government ID, business registration documents, or other proof.

4. How long does AWS MFA recovery take?

Self-service recovery (if you have email/phone access) takes minutes to hours. If you need AWS Support, it can take days to weeks due to the verification process.

5. What's the difference between root user and IAM user MFA recovery?

Root users can self-service reset via email/phone verification, while IAM users require administrator intervention. Root users are the only ones who can recover access without admin help.

6. Can I use the AWS CLI to list MFA devices for the root user?

The aws iam list-mfa-devices command only lists MFA devices for IAM users, not the root user. Use aws iam list-virtual-mfa-devices instead to see root user MFA devices.

7. What should I do if my MFA device is damaged but still generates codes?

If it's a virtual MFA device, you can deactivate it in the AWS Console and activate a new one. For hardware devices, you may need to contact AWS Support if you can't access your account.

8. How do I enable MFA for an IAM user?

In the AWS Console, navigate to IAM > Users > [username] > Security credentials > Manage MFA device. Choose the MFA type (virtual or hardware) and follow the prompts.

9. What is MFA delete in AWS?

MFA delete is a feature for S3 buckets that requires MFA authentication to delete versions of objects or enable versioning. It's separate from account MFA but adds another layer of security.

10. Can I have multiple MFA devices for the same AWS account?

No. Each IAM user or root user can only have one active MFA device at a time. You must deactivate the old one before activating a new one.

11. What happens if I don't enable MFA on my AWS account?

Your account is less secure, but it will still function. However, AWS may prompt you to enable MFA for better security.

12. How do I remove MFA from my AWS root account?

You shouldn't remove MFA from the root account for security reasons. If you must, you can do it via the IAM Console, but it's strongly discouraged.

13. What should I do if my MFA device is lost but I still have my password?

If you're the root user, use the "Forgot MFA device?" link on the sign-in page. If you're an IAM user, contact your administrator.

14. Can AWS support help me if I'm locked out of my account?

Yes, AWS Support can help, but you'll need to provide proof of identity and account ownership. The process can be lengthy.

15. How do I prevent MFA lockouts?

Have multiple administrators with MFA access, store root credentials securely, and consider hardware MFA keys. Regularly review access and update contact information.

16. What is the 35-day MFA enforcement window?

AWS may require users to register MFA within 35 days of their first sign-in attempt to access the AWS Management Console if MFA is not already enabled.

Conclusion: Secure Your AWS Account Today

Losing your AWS MFA device is a stressful experience, but recovery is possible. The key is to act quickly and follow the appropriate path based on your user type. More importantly, take steps now to prevent lockouts by implementing multiple administrators, securing root credentials, and regularly reviewing your access controls.

Remember: the root user with MFA is your last line of defense. Protect it, delegate daily tasks to IAM users, and always have a recovery plan in place.

Revision note. Written September 2026, covering AWS IAM MFA recovery . AWS support processes and documentation may evolve, so always check the official AWS documentation for the latest updates. If you're currently locked out, stay persistent—account recovery is possible with the right documentation and patience.