Unable to deactivate or delete aws iam mfa device

user_1804749 0
Viewed 2135

I am AWS admin. I have followed the instructions to enforce MFA for all my users. One of my users receives an "Entity Already exists" error. The dialog asks the user to "ask your administrator to delete the existing device using the CLI..." That's me. I have had no luck doing this.

If I use the CLI to list-virtual-mfa-devices I see this. The user in question is 'userBob'. As you can see the SerialNumber of his existing device shows up without the "User" attached.

{
    "VirtualMFADevices": [
        {
            "SerialNumber": "arn:aws:iam::xxxxx:mfa/userBob"
        },
        {
            "SerialNumber": "arn:aws:iam::xxxxxxxxx:mfa/root-account-mfa-device",
            "User": {
                "UserName": "mycompany",
                "UserId": "xxxxx",
                "Arn": "arn:aws:iam::xxxxxx:root",
                "CreateDate": "2010-10-12T18:54:24+00:00",
                "PasswordLastUsed": "2020-05-27T20:28:12+00:00"
            },
            "EnableDate": "2020-05-19T19:06:11+00:00"
        },

If I run this command:

aws iam deactivate-mfa-device --serial-number arn:aws:iam::xxxxxxxxx:mfa/userBob --user-name userBob

I get this error An error occurred (AccessDenied) when calling the DeactivateMFADevice operation: User: arn:aws:iam::xxxxxxx:user/meKevinAdminGuy is not authorized to perform: iam:DeactivateMFADevice on resource: user userBob with an explicit deny

I have certainly never placed an explicit deny on any iam actions. I have no way to find where the explicit deny is. I've given myself all iam permissions.

Running the aws iam delete-virtual-mfa-device gives the same error. Can't deactivate it. Can't delete it. Don't know where the 'explicit deny' is coming from.

amazon-iam aws-cli amazon-web-services
1 Answers

I ran into this same problem, and it was indeed due to the policy. I had an "Effect": "Deny" and a "NotAction" list which didn't include "iam:DeleteVirtualMFADevice" in it. This in effect explicitly denied that action. You can read about "NotAction with Deny" in the IAM JSON policy elements: NotAction section of the IAM documentation here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html

I attached the managed policy AdministratorAccess to my own user (for you, apply it to "meKevinAdminGuy"), then removed myself from other policies/groups I was a part of that were causing this explicit deny.

With only AdministratorAccess policy, I did not experience that explicit deny when deleting the detached MFA serial. Once I'd managed to remove it, I just restored my previous permissions set by re-attaching those policies and groups, and finally removing myself from the AdministratorAccess policy.

user_54314610
Related