use*_*779 23 amazon-web-services amazon-iam
我希望强制所有IAM用户(本地和远程)启用和激活他们的MFA设备.我希望他们都能让MFA完成各自的任务.
我正在尝试以下政策
{
"Effect": "Allow",
"Action": "*",
"Resource": "*",
"Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}
}
然而; 无论您如何通过控制台或API访问服务,此政策均适用
由于没有暗示MFA身份验证,所有用户都会自动执行大量自动化操作并实现自动化.
作为第一步,我们希望每个人至少能够通过MFA进行控制台登录; 但同样不应强制它们将MFA用于自动化中使用的API调用.
这可以通过IAM政策实现吗？
谢谢
Jos*_*ock 22
诀窍是反转检查...而不是只允许如果aws:MultiFactorAuthPresent为真,否则如果它是假的.
以下是有关自助式MFA管理的文档:http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-mfa-and-creds.html
建议的完整政策是:
{
"Version": "2012-10-17",
"Statement":[
{
"Sid": "AllowAllUsersToListAccounts",
"Effect": "Allow",
"Action":[
"iam:ListAccountAliases",
"iam:ListUsers",
"iam:GetAccountSummary"
],
"Resource": "*"
},
{
"Sid": "AllowIndividualUserToSeeAndManageTheirOwnAccountInformation",
"Effect": "Allow",
"Action":[
"iam:ChangePassword",
"iam:CreateAccessKey",
"iam:CreateLoginProfile",
"iam:DeleteAccessKey",
"iam:DeleteLoginProfile",
"iam:GetAccountPasswordPolicy",
"iam:GetLoginProfile",
"iam:ListAccessKeys",
"iam:UpdateAccessKey",
"iam:UpdateLoginProfile",
"iam:ListSigningCertificates",
"iam:DeleteSigningCertificate",
"iam:UpdateSigningCertificate",
"iam:UploadSigningCertificate",
"iam:ListSSHPublicKeys",
"iam:GetSSHPublicKey",
"iam:DeleteSSHPublicKey",
"iam:UpdateSSHPublicKey",
"iam:UploadSSHPublicKey"
],
"Resource": "arn:aws:iam::accountid:user/${aws:username}"
},
{
"Sid": "AllowIndividualUserToListTheirOwnMFA",
"Effect": "Allow",
"Action":[
"iam:ListVirtualMFADevices",
"iam:ListMFADevices"
],
"Resource":[
"arn:aws:iam::accountid:mfa/*",
"arn:aws:iam::accountid:user/${aws:username}"
]
},
{
"Sid": "AllowIndividualUserToManageTheirOwnMFA",
"Effect": "Allow",
"Action":[
"iam:CreateVirtualMFADevice",
"iam:DeactivateMFADevice",
"iam:DeleteVirtualMFADevice",
"iam:RequestSmsMfaRegistration",
"iam:FinalizeSmsMfaRegistration",
"iam:EnableMFADevice",
"iam:ResyncMFADevice"
],
"Resource":[
"arn:aws:iam::accountid:mfa/${aws:username}",
"arn:aws:iam::accountid:user/${aws:username}"
]
},
{
"Sid": "BlockAnyAccessOtherThanAboveUnlessSignedInWithMFA",
"Effect": "Deny",
"NotAction": "iam:*",
"Resource": "*",
"Condition":{
"BoolIfExists":{ "aws:MultiFactorAuthPresent": "false"}
}
}
]
}
最重要的部分是最后一个声明,它做了否认.如果您将其更改为:
{
"Sid": "BlockAnyAccessOtherThanAboveUnlessSignedInWithMFA",
"Effect": "Deny",
"NotAction": "iam:*",
"Resource": "*",
"Condition":{
"Bool":{ "aws:MultiFactorAuthPresent": "false"}
}
}
(BoolIfExists改为Bool)它将允许IAM访问密钥绕过MFA的要求,同时仍然要求您在通过AWS控制台登录时使用MFA.
如果您决定使用文档中的完整策略,请务必小心.请注意,它允许用户创建访问密钥并更改其密码,而deny子句仅阻止非IAM操作...这意味着,如果在帐户上禁用MFA,则可以更改用户的密码或新的访问密钥可以在没有MFA检查的情况下进行配置,如果您更改了Bool,那么这些新的访问密钥将能够访问用户拥有权限的任何内容,而无需MFA.IE,不安全密钥的所有安全漏洞,有一些潜在的帐户劫持.
我建议使用类似于此的政策:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAllUsersToListAccounts",
"Effect": "Allow",
"Action": [
"iam:ListAccountAliases",
"iam:ListUsers"
],
"Resource": [
"arn:aws:iam::accountid:user/*"
]
},
{
"Sid": "AllowIndividualUserToSeeTheirAccountInformation",
"Effect": "Allow",
"Action": [
"iam:GetAccountPasswordPolicy",
"iam:GetAccountSummary",
"iam:GetLoginProfile"
],
"Resource": [
"arn:aws:iam::accountid:user/${aws:username}"
]
},
{
"Sid": "AllowIndividualUserToListTheirMFA",
"Effect": "Allow",
"Action": [
"iam:ListVirtualMFADevices",
"iam:ListMFADevices"
],
"Resource": [
"arn:aws:iam::accountid:mfa/*",
"arn:aws:iam::accountid:user/${aws:username}"
]
},
{
"Sid": "AllowIndividualUserToManageThierMFA",
"Effect": "Allow",
"Action": [
"iam:CreateVirtualMFADevice",
"iam:DeactivateMFADevice",
"iam:DeleteVirtualMFADevice",
"iam:EnableMFADevice",
"iam:ResyncMFADevice"
],
"Resource": [
"arn:aws:iam::accountid:mfa/${aws:username}",
"arn:aws:iam::accountid:user/${aws:username}"
]
},
{
"Sid": "DoNotAllowAnythingOtherThanAboveUnlessMFAd",
"Effect": "Deny",
"NotAction": "iam:*",
"Resource": "*",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
]
}
为每个人创建2个IAM用户：
后代发布。我尝试使用Josh Hancock发布的方法，但是对于某些AWS服务（例如弹性文件系统和某些s3 api调用），来自强制控制台MFA帐户的api调用失败。收到支持票时，AWS的回答是：“由于该问题尚不存在可靠的机制，仅针对控制台实施MFA，因此存在针对此精确问题的功能请求。我已将您的帐户添加到以下请求的帐户列表中不幸的是，除了在所有地方启用MFA或仅将IAM MFA策略应用于仅作为控制台的用户外，我没有可靠的解决方法。”
小智 6
经过几年的等待。AWS 最终提供了一种方法来做到这一点。 https://aws.amazon.com/premiumsupport/knowledge-center/mfa-iam-user-aws-cli/
{
"Sid": "BlockMostAccessUnlessSignedInWithMFA",
"Effect": "Deny",
"NotAction": [
"iam:CreateVirtualMFADevice",
"iam:DeleteVirtualMFADevice",
"iam:ListVirtualMFADevices",
"iam:EnableMFADevice",
"iam:ResyncMFADevice",
"iam:ListAccountAliases",
"iam:ListUsers",
"iam:ListSSHPublicKeys",
"iam:ListAccessKeys",
"iam:ListServiceSpecificCredentials",
"iam:ListMFADevices",
"iam:GetAccountSummary",
"sts:GetSessionToken"
],
"Resource": "*",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "false",
"aws:ViaAWSService": "false"
}
}
}
我有一个不同的解决方案。我有一个“ForceMFA”组，除非您启用了 MFA，否则它不允许您执行任何操作（分配 MFA 除外）。我有一个每小时运行一次的小脚本，它扫描所有用户并将没有 MFA 的任何用户添加到“ForceMFA”组。同一脚本还会从组中删除启用了 MFA 的用户。这样，我强制人们启用 MFA，但不需要对 API 调用进行 MFA。
这是我使用的小型 Powershell 6 脚本：https : //gist.github.com/kalpik/36beffd25bda2a0c38905176f7e557aa
| 归档时间： |
|
| 查看次数： |
6793 次 |
| 最近记录： |