Effective DevOps with AWS

Enforcing the use of MFA devices

At this point, users who are part of the AllUsers groups have enough permissions to manage their accounts. We can now restrict the permissions of users who don't have their accounts configured to use an MFA device or didn't refresh their sessions in a certain amount of time. To do that, we will add two new statements to the CommonIamPolicypolicy as follows:

1. Reopen the script in your editor.
2. We will first add a few extra classes in the awacs.aws import section around Line 18. We will add:

from awacs.aws import ( 
    Action, 
    Allow, 
    Condition, 
    NumericGreaterThan, 
    Deny, 
    Null, 
    Policy, 
    Statement, 
) 

3. Now that this is in place, we can add our new entries in the statement array of the CommonIamPolicy managed policy. ...