title: “Passkeys (FIDO2/WebAuthn)” created: 2026-10-23 updated: 2026-10-23 type: knowledge tags:

aws
iam
security
certification
authentication
mfa

Passkeys (FIDO2/WebAuthn)

What It Is

A passkey is a phishing-resistant authentication credential based on public-key cryptography (the FIDO2 / WebAuthn standard). A key pair is generated: the private key never leaves the authenticator (e.g. 1Password, a hardware key, or the device’s secure enclave), and the public key is registered with the service (e.g. AWS).

Do NOT confuse a passkey with AWS access keys. Access keys (Access Key ID + Secret Access Key) are long-lived programmatic credentials for the CLI/SDK/API. A passkey is an interactive sign-in / MFA credential — a completely different thing.

Why It Matters

Passkeys are the strongest practical sign-in method for the AWS Console because they are resistant to phishing: a fake AWS login page cannot capture a reusable secret, since nothing reusable is ever transmitted. They are recommended for high-value identities such as the root user and admin IAM users.

Key Concepts

Term	Meaning
Private key	Secret half, stored in the authenticator, never shared
Public key	Registered with the relying party (AWS) for verification
Relying party	The service verifying the login (AWS Console)
Authenticator	Where the private key lives (1Password, YubiKey, device enclave)
Challenge	Random value AWS sends; the authenticator signs it with the private key

Passkey vs TOTP (MFA)

TOTP (6-digit code, e.g. 1Password Auth-App): a shared secret both sides know; phishable if the user is tricked into typing the code on a fake site.
Passkey: origin-bound signature; the authenticator refuses to sign for the wrong domain, so it cannot be phished.

Usage in AWS

A passkey on the AWS Console can be used:

As a phishing-resistant MFA second factor (on top of a password), or
As a full sign-in credential, depending on the AWS sign-in flow and identity type.

Applicable to the root user and IAM users sign-in (signin.aws.amazon.com).

How It Works

Registration: authenticator generates a key pair, sends the public key to AWS.
Sign-in: AWS sends a challenge → authenticator signs it with the private key.
AWS verifies the signature with the stored public key. No password is transmitted.

Examples

Root user: register a passkey (in 1Password) as a strong MFA/sign-in method, while keeping the existing TOTP MFA as a backup factor.
Admin IAM user (benoitAsAdmin): same approach — passkey plus a fallback factor.

Gotchas

Single point of failure: if the passkey lives only in 1Password, access to the 1Password vault becomes the single point of failure for the AWS root. Always keep a second MFA method registered on each identity; never leave root with only one.
Recovery: keep the 1Password Emergency Kit and master password stored offline.
Not for the CLI: passkeys cover interactive Console sign-in, not aws login (SSO) or programmatic access. Daily CLI access still goes through Identity Center.
A passkey is not an AWS access key — different purpose, different lifecycle.

AWS Certification Notes