Home / server / Questions / 800411
In Process
Yeleshwar
Asked: 2016-09-01 23:40:00 +0800 CST

Automating the MFA Device Activation for IAM Users

  • 772

I am creating more than 20 IAM users and I want to enable virtual MFA device for them. Is there any way I can do it at once for all of them or any way to automate this task ? I want to make it mandatory for all IAM users to use MFA and without setting it up they can't proceed.

amazon-web-services amazon-iam

2 Answers

  1. My solution to this is a two step activation process for new users:

    1. Create the user with enough rights to change their password and update their MFA. Tell them they need to update their MFA. They do not get into their 'real' groups yet.
    2. Have a polling script that runs periodically. If a user has their MFA activated, they get added to their designated groups.

    Users who don't update their MFA will be able to do... nothing. When they complain, send them the reminder of how to update their MFA. When they come back with OK, I've done it, run the #2 script.

    • 1

  2. What about the following page, seems to answer your problem: http://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_cliapi.html

    • -2