How do I enable VirtualMFADevice in CloudFormation?

user_566869 0
Viewed 80

I have a CloudFormation script that creates new users (with roles, policies etc).

I am hoping to ensure the new users have MFA enabled. The docs mention you have to "attach the MFA device to an IAM user after creating the MFA" (even though there is a Users property as below?) but they only point to how to do this in the console and CLI.

  Type: AWS::IAM::VirtualMFADevice
    Properties:
      Users:
          - !Ref user1
          - !Ref user2
      VirtualMfaDeviceName: Something

Is this operation not supported in CloudFormation maybe?

multi-factor-authentication amazon-cloudformation amazon-web-services
1 Answers

An MFA device is something that a user manages for himself/herself. In order to ensure that the users have MFA enabled, you can use an IAM Policy. This example policy from Amazon explicitly denies all permissions for users (even, if there are other policies allowing them), unless they have MFA enabled. The only thing permitting is managing their own MFA device, so that they can add a device for themselves. These are the details for users managing their MFA devices.

user_240540
Related