How do I troubleshoot the "MFA device already exists" error when an IAM user tries to create a new MFA device?

Resolution

If you create an MFA device but you don't activate it for IAM users, then this error occurs when you create a new MFA device. This error occurs only when you use the AWS Command Line Interface (AWS CLI) to create a new MFA device. First, use the AWS CLI to delete the MFA device. Then, recreate the MFA device.

Note: If you receive errors when you run AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Complete the following steps:

1. To list all virtual MFA devices created in your AWS account, run the list-virtual-mfa-devices AWS CLI command:

   aws iam list-virtual-mfa-devices --assignment-status Unassigned

2. Note the MFA device serial number that aligns with the name that you're creating.

3. To delete the MFA device, run the delete-virtual-mfa-device AWS CLI command:

   aws iam delete-virtual-mfa-device --serial-number arn:aws:iam::account-id:mfa/device-name

4. Create a new MFA device.
   Follow the instructions to activate a virtual MFA device for an IAM user (console).
   -or-
   Follow the instructions to assign MFA devices in the AWS CLI or AWS API.

If you don't find unassigned devices with the same name, then that same device name was used for an MFA device by another user. Use a different name for your MFA device.

Related information

How do I enforce MFA authentication for IAM users that use the AWS Management Console and the AWS CLI?

Using multi-factor authentication

How do I use the AWS CLI to authenticate access to AWS resources with an MFA token?