unbounce / iidy

iidy (Is it done yet?) -- CloudFormation with Confidence

MIT License

52 stars 7 forks source link

MFA requirement on IAM role trust policies are not supported by iidy #112

Closed scottbrown closed 6 years ago

scottbrown commented 6 years ago

iidy does not support the functionality of MFA requirements on role assumptions (--profile in AWS CLI parlance). This is used to enforce role assumptions constraints when working with escalated IAM role privileges or working in a multi-account structure.

iidy ... --profile other-account

will return an STS assume role error.

tavisrudd commented 6 years ago

Related issue upstream: https://github.com/aws/aws-sdk-js/issues/1543

tavisrudd commented 6 years ago

There's some code on another issue that points at a way to resolve the issue with a call to aws.SharedIniFileCredentials followed by aws.TemporaryCredentials https://github.com/aws/aws-sdk-js/issues/1064

tavisrudd commented 6 years ago

I'm working on a fix for this. We'll also need to cover AssumeRoleArn, in which case the mfa serial number will need passing in as it won't be in ~/.aws/credentials.

tavisrudd commented 6 years ago

James and I came up with a solution in #119.

tavisrudd commented 6 years ago

119 has been merged so can test it out with MFA on developer laptops after cutting a new release.

jpb commented 6 years ago

Another solution it to have the SDK prompt user for the MFA token as per https://github.com/aws/aws-sdk-js/pull/2126

tavisrudd commented 6 years ago

This is resolved.