Created
August 16, 2021 14:24
-
-
Save rhemz/e1e85664c26a740e3d8b38a34c99b5ff to your computer and use it in GitHub Desktop.
Require MFA IAM Policy
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
{ | |
"Version": "2012-10-17", | |
"Statement": [ | |
{ | |
"Action": [ | |
"iam:CreateVirtualMFADevice", | |
"iam:ListVirtualMFADevices", | |
"iam:DeactivateMFADevice", | |
"iam:DeleteVirtualMFADevice", | |
"iam:EnableMFADevice", | |
"iam:ResyncMFADevice", | |
"iam:ListMFADevices" | |
], | |
"Resource": [ | |
"arn:aws:iam::<AccountID>:mfa/${aws:username}", | |
"arn:aws:iam::<AccountID>:user/${aws:username}", | |
"arn:aws:iam::<AccountID>:mfa/" | |
], | |
"Effect": "Allow", | |
"Sid": "AllowIndividualUserToManageTheirMFA" | |
}, | |
{ | |
"NotAction": "iam:*", | |
"Resource": "*", | |
"Effect": "Deny", | |
"Condition": { | |
"Null": { | |
"aws:MultiFactorAuthAge": "true" | |
} | |
}, | |
"Sid": "DoNotAllowAnythingOtherThanAboveUnlessMFAd" | |
} | |
] | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment