Skip to content

Instantly share code, notes, and snippets.

@fxaguessy

fxaguessy/ManageOwnMFA.aws

Created October 6, 2017 09:38
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save fxaguessy/ef9511bf5ed8f3312904cccb96b818e8 to your computer and use it in GitHub Desktop.
Save fxaguessy/ef9511bf5ed8f3312904cccb96b818e8 to your computer and use it in GitHub Desktop.
Download ZIP
Awless template to create policy allowing users to manage only their own virtual MFA devices
Raw
ManageOwnMFA.aws
# Create policy allowing users to manage only their own virtual MFA devices
# cf. http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_delegate-permissions_examples.html#creds-policies-mfa-console
mfaResource = "arn:aws:iam::" + {account.id} + ":mfa/${aws:username}"
userResource = "arn:aws:iam::" + {account.id} + ":user/${aws:username}"
policy = create policy name=ManageOwnMFADevice effect=allow action=[iam:CreateVirtualMFADevice,iam:EnableMFADevice,iam:ResyncMFADevice,iam:DeleteVirtualMFADevice] resource=$mfaResource,$userResource
update policy arn=$policy effect=allow action=iam:DeactivateMFADevice resource=[$mfaResource,$userResource] conditions="aws:MultiFactorAuthPresent==true"
update policy arn=$policy effect=allow action=[iam:ListMFADevices,iam:ListVirtualMFADevices,iam:ListUsers] resource=*
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment