MFA can be used either with a specific MFA-enabled device or by installing an application on asmartphone. If a user chooses to use her smartphone, physical access to the device is required inorder to complete the configuration wizard. http://docs.aws.amazon.com/IAM/latest/UserGuide/GenerateMFAConfig.html