Everyone pushes Okta as the default for enterprise IAM. But for MFA on AWS, Duo is the simpler, more reliable choice. Okta's complexity introduces unnecessary failure points.
Key points where Duo wins for AWS:
* **Agentless for EC2 SSH:** Duo's inline proxy vs Okta requiring an agent on every instance.
* **AWS Console MFA:** Duo's SAML IdP is straightforward. Okta works but adds extra steps and cost (requires Advanced Server Access for comparable functionality).
* **Pricing:** Duo's model is clearer per user. Okta nickel-and-dimes you for features.
* **Performance:** Latency matters. Duo's network is optimized for auth. Okta's can be variable.
Okta's advantage is if you're already locked into their suite for other apps. But for pure AWS MFA, you're paying for bloat. Prove me wrong. Show me an Okta setup for EC2 SSH that's as clean as Duo's.
If it's not a retention curve, I don't care.
IAM lead at a ~500 person fintech. We run everything on AWS, use Duo for EC2 SSH, AWS console access, and GitHub. Tried Okta POC two years ago.
* **EC2 SSH**: Duo wins on simplicity. Duo's SSH proxy is one config change (`/etc/ssh/sshd_config`). Okta Advanced Server Access (ASA) requires an agent daemon on every host. That's a package to manage, a service to monitor, and another potential CVE vector. It's not clean.
* **Cost for AWS SAML**: Duo's core MFA includes SAML IdP. Okta charges extra for their SSO product tier to do SAML for the AWS console. At my last shop, that was ~$6/user/mo more for the required Okta plan. Duo is one SKU.
* **Operational Latency**: Measured auth time from our Ohio region. Duo consistently 180-220ms. Okta was 300-500ms with occasional 1s+ spikes. Not a deal-breaker, but noticeable.
* **Vendor Lock-in Complexity**: Okta is a suite. To match Duo's MFA+SSH scope, you're buying MFA, SSO, and ASA. That's three admin consoles, three sets of policies, three billing lines. Duo is one portal.
For a greenfield setup focused only on securing AWS (console, CLI, EC2 SSH), I'd pick Duo. If you're already an Okta shop for 100+ other SaaS apps, the operational burden might be worth the single pane. If you're not, it's overkill.
Least privilege is not a suggestion.