Skip to content

Instantly share code, notes, and snippets.

@functionoffunction

functionoffunction/MFA policy

Created September 2, 2020 21:39
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save functionoffunction/bdccf01d753aef272b3b2fa3a57cecce to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save functionoffunction/bdccf01d753aef272b3b2fa3a57cecce to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. functionoffunction created this gist Sep 2, 2020.
    111 changes: 111 additions & 0 deletions MFA policy
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,111 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "AllowViewAccountInfo",
    "Effect": "Allow",
    "Action": [
    "iam:GetAccountPasswordPolicy",
    "iam:GetAccountSummary",
    "iam:ListVirtualMFADevices",
    "iam:ListUsers"
    ],
    "Resource": "*"
    },
    {
    "Sid": "AllowManageOwnPasswords",
    "Effect": "Allow",
    "Action": [
    "iam:ChangePassword",
    "iam:GetUser"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnAccessKeys",
    "Effect": "Allow",
    "Action": [
    "iam:CreateAccessKey",
    "iam:DeleteAccessKey",
    "iam:ListAccessKeys",
    "iam:UpdateAccessKey"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnSigningCertificates",
    "Effect": "Allow",
    "Action": [
    "iam:DeleteSigningCertificate",
    "iam:ListSigningCertificates",
    "iam:UpdateSigningCertificate",
    "iam:UploadSigningCertificate"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnSSHPublicKeys",
    "Effect": "Allow",
    "Action": [
    "iam:DeleteSSHPublicKey",
    "iam:GetSSHPublicKey",
    "iam:ListSSHPublicKeys",
    "iam:UpdateSSHPublicKey",
    "iam:UploadSSHPublicKey"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnGitCredentials",
    "Effect": "Allow",
    "Action": [
    "iam:CreateServiceSpecificCredential",
    "iam:DeleteServiceSpecificCredential",
    "iam:ListServiceSpecificCredentials",
    "iam:ResetServiceSpecificCredential",
    "iam:UpdateServiceSpecificCredential"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnVirtualMFADevice",
    "Effect": "Allow",
    "Action": [
    "iam:CreateVirtualMFADevice",
    "iam:DeleteVirtualMFADevice"
    ],
    "Resource": "arn:aws:iam::*:mfa/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnUserMFA",
    "Effect": "Allow",
    "Action": [
    "iam:DeactivateMFADevice",
    "iam:EnableMFADevice",
    "iam:ListMFADevices",
    "iam:ResyncMFADevice"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "DenyAllExceptListedIfNoMFA",
    "Effect": "Deny",
    "NotAction": [
    "iam:CreateVirtualMFADevice",
    "iam:EnableMFADevice",
    "iam:GetUser",
    "iam:ListMFADevices",
    "iam:ListVirtualMFADevices",
    "iam:ResyncMFADevice",
    "sts:GetSessionToken",
    "iam:ListUsers"
    ],
    "Resource": "*",
    "Condition": {
    "BoolIfExists": {
    "aws:MultiFactorAuthPresent": "false"
    }
    }
    }
    ]
    }