Create mfa enforcement policy and add it to existing groups

[gmgonzal]

Fixes #22

What changes did you make?

• Use terraform to create a new policy EnforceMFAForUsers.
• Use terraform to attach the new policy to all existing groups.

Why did you make the changes (we will use this info to test)?

• We want to enforce MFA authentication for all users.

New Policy Created

Group Policies Updated

Users without MFA have limited access

[github-actions]

Terraform plan in terraform
With backend config files: terraform/prod.backend.tfvars

Plan: 3 to add, 2 to change, 0 to destroy.

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
!~  update in-place

Terraform will perform the following actions:

  # module.aws_custom_policies.aws_iam_policy.custom_policy["EnforceMFAForUsers"] will be created
+   resource "aws_iam_policy" "custom_policy" {
+       arn              = (known after apply)
+       attachment_count = (known after apply)
+       description      = "Policy enforcing MFA for devops security users"
+       id               = (known after apply)
+       name             = "EnforceMFAForUsers"
+       name_prefix      = (known after apply)
+       path             = "/"
+       policy           = jsonencode(
            {
+               Statement = [
+                   {
+                       Condition = {
+                           BoolIfExists = {
+                               "aws:MultiFactorAuthPresent" = "false"
                            }
                        }
+                       Effect    = "Deny"
+                       NotAction = [
+                           "iam:CreateVirtualMFADevice",
+                           "iam:EnableMFADevice",
+                           "iam:GetUser",
+                           "iam:GetMFADevice",
+                           "iam:ListMFADevices",
+                           "iam:ListVirtualMFADevices",
+                           "iam:ResyncMFADevice",
+                           "sts:GetSessionToken",
                        ]
+                       Resource  = "*"
+                       Sid       = "EnforceMFAForUsers"
                    },
                ]
+               Version   = "2012-10-17"
            }
        )
+       policy_id        = (known after apply)
+       tags_all         = (known after apply)
    }

  # module.iam_oidc_gha_incubator.aws_iam_openid_connect_provider.github_actions will be updated in-place
!~  resource "aws_iam_openid_connect_provider" "github_actions" {
        id              = "arn:aws:iam::035866691871:oidc-provider/token.actions.githubusercontent.com"
        tags            = {}
!~      thumbprint_list = [
!~          "d89e3bd43d5d909b47a18977aa9d5ce36cee184c" -> "2b18947a6a9fc7764fd8b5fb18a863b0c6dac24f",
        ]
#        (4 unchanged attributes hidden)
    }

  # module.iam_oidc_gha_incubator.aws_iam_role.github_actions_oidc will be updated in-place
!~  resource "aws_iam_role" "github_actions_oidc" {
!~      assume_role_policy    = jsonencode(
!~          {
!~              Statement = [
!~                  {
!~                      Condition = {
!~                          StringLike   = {
!~                              "token.actions.githubusercontent.com:sub" = "*******************************************************************************************"
                            }
#                            (1 unchanged attribute hidden)
                        }
#                        (3 unchanged attributes hidden)
                    },
-                   {
-                       Action    = "sts:AssumeRoleWithWebIdentity"
-                       Condition = {
-                           StringEquals = {
-                               "token.actions.githubusercontent.com:aud" = "*****************"
-                               "token.actions.githubusercontent.com:sub" = "*************************************"
                            }
                        }
-                       Effect    = "Allow"
-                       Principal = {
-                           Federated = "arn:aws:iam::035866691871:oidc-provider/token.actions.githubusercontent.com"
                        }
                    },
                ]
#                (1 unchanged attribute hidden)
            }
        )
        id                    = "gha-incubator"
        name                  = "gha-incubator"
        tags                  = {}
#        (11 unchanged attributes hidden)
    }

  # module.iam_read_only_group.aws_iam_group_policy_attachment.group_policy_attachment["EnforceMFAForUsers"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "read-only-group"
+       id         = (known after apply)
+       policy_arn = (known after apply)
    }

  # module.iam_services_supervisor_group.aws_iam_group_policy_attachment.group_policy_attachment["EnforceMFAForUsers"] will be created
+   resource "aws_iam_group_policy_attachment" "group_policy_attachment" {
+       group      = "iam-services-supervisor-group"
+       id         = (known after apply)
+       policy_arn = (known after apply)
    }

Plan: 3 to add, 2 to change, 0 to destroy.

Warning: Argument is deprecated

  with module.iam_oidc_gha_incubator.aws_iam_role.github_actions_oidc,
  on modules/aws-gha-oidc-providers/main.tf line 54, in resource "aws_iam_role" "github_actions_oidc":
  54:   managed_policy_arns = var.policy_arns

managed_policy_arns is deprecated. Use the aws_iam_role_policy_attachment
resource instead. If Terraform should exclusively manage all managed policy
attachments (the current behavior of this argument), use the
aws_iam_role_policy_attachments_exclusive resource as well.

✅ Plan applied in Apply Terraform changes on merge #29

[ale210]

Great job @gmgonzal , thanks!

[gmgonzal]

My pleasure! I can help update the wiki as well to include information on how to create a session token and update the aws credentials file to authenticate via CLI now that MFA is enabled by default. Is there a wiki I can update with this info?