le-tf-infra-aws icon indicating copy to clipboard operation
le-tf-infra-aws copied to clipboard

Documentation regarding MFA creation using base_identities, clarify MFA name

Open juanmatias opened this issue 2 years ago • 2 comments

What?

In the documentation, regarding the MFA creation we have these lines:

Proceed to enable a virtual MFA device for your user, and generate programmatic keys for it. Make sure to keep these keys in a safe location.

There should be clarified the user name has to be used in order to be able to create the MFA. E.g.:

Proceed to enable a virtual MFA device for your user (name it after your username), and generate programmatic keys for it. Make sure to keep these keys in a safe location.

Why?

Based on the self-management policy created by the base_identities layer, we have the iam:CreateVirtualMFADevice but the resource is limited to arn:aws:iam::${var.accounts[var.environment].id}:mfa/$${aws:username}. This means the mfa should be named the same as the username.

juanmatias avatar Jan 05 '23 13:01 juanmatias