‫So we are going to first define
‫a password policy.
‫For this click on Account Settings
‫on the left hand side.
‫You will find Password Policy and you can edit it.
‫So here we can use the IAM default password policy
‫which composes of these kind of requirements,
‫or we can customize the password policy
‫and force a password minimum length.
‫We can also require uppercase letter,
‫lowercase letter, a number, a non-alphanumeric character.
‫We can also turn on password expiration
‫to turn on, for example, expire after 90 days,
‫or that a password expiration
‫requires administrative resets,
‫or we can allow the users to change their own password,
‫or we can prevent password reuse.
‫So this password can be edited directly
‫from the IAM console, and that's the first part of security.
‫The second part is around
‫setting multi-factor authentication
‫for your root account.
‫So if you click on the account name
‫and then click on Security Credentials,
‫if you are logged in with the root user
‫you will see My Security Credentials, Root User.
‫You will not have access to this
‫if you're not logged in with a root user.
‫Now, there is a way for you
‫to actually protect your root user,
‫which is the most important account in your AWS accounts,
‫and you can protect it by using multi-factor authentication.
‫Now, just so you know, I'm going to do it
‫and demonstrate how it works in front of you,
‫but I've had students who locked themselves
‫out of their accounts because they lost access
‫to their multi-factor authentication device.
‫As such, if you think you are running the risk
‫of losing your iPhone or whatever, do not do this.
‫Just keep your phone with you, just watch my video.
‫It will be good enough.
‫If you want to practice along with me, you can as well.
‫And you can also delete the MFA device after activating it.
‫Okay, but let's go ahead and assign an MFA device.
‫So I will call this one my iPhone
‫because this is what I have,
‫but you can name it whatever you want.
‫Then you can select the type of MFA device.
‫So it could be an authenticator app,
‫which is something I'm going to use,
‫but also it can be a security key
‫or a hardware TOTP token.
‫So I'm going to use an authenticator app
‫because it will be virtual.
‫And now we go into the setup of the app.
‫So there's a list of compatible applications right here
‫that you can find here for Android and for iOS
‫that we know work well with AWS.
‫And as such I'm going to use the Twilio Authy Authenticator,
‫which is an app I like.
‫And that's something that can be used
‫on your computer, on your devices, so it's kind of nice.
‫So what I have to do then is actually
‫launch the app on my phone,
‫and then you click on Show QR Code.
‫So when you show the QR code
‫you need to scan this QR code directly on your phone.
‫So for this you add an account,
‫you scan the QR code right here,
‫and once scanned it will add the account
‫and start naming it.
‫So we'll just save this, this looks good.
‫And then we get access to MFA codes.
‫So there is the first MFA code,
‫so 301935.
‫So this is a code generated by my iPhone in real time.
‫And this code is going to change over time.
‫And the reason why the two codes are asked by AWS
‫is that it wants to make sure that the MFA device
‫is set up correctly, and that the codes are accurate.
‫So the second code is 792843.
‫And, of course, they will be different for your device.
‫And once these two codes are entered, you click on Add MFA.
‫And as you can see
‫we can register up to eight MFA devices currently.
‫And you can scroll down and see them right here on the list.
‫So the multi-factor authentication MFA 1
‫is called my iPhone that's been created right now.
‫So if you wanted to remove it, you can remove it, and so on.
‫But so how do you use MFA?
‫Well now if I log out of AWS and I log back in,
‫so I'm going to use my root account and my password.
‫Now after doing a successful login
‫I have the MFA code to enter.
‫And so I open my app
‫and enter the code that I see, and press Submit.
‫And this way I am logged in.
‫And this is perfect because well
‫we add an extra level of security on our account.
‫So that's it for this lecture.
‫I hope you liked it,
‫and I will see you in the next lecture.