Issues with AssumeRole and MFA?

[Jd Daniel]

Having a terrible time getting TF to assumerole with another account, here's my setup

AWS Config

    [default]
    region = us-west-2
    output = json

    [profile GEHC-000]
    region = us-west-2
    output = json

    ....

    [profile GEHC-056]
    source_profile = GEHC-000
    role_arn = arn:aws:iam::~069:role/hc/hc-master
    mfa_serial = arn:aws:iam::~183:mfa/username
    external_id = ~069

AWS Credentials

    [default]
    aws_access_key_id = xxx
    aws_secret_access_key = xxx


    [GEHC-000]
    aws_access_key_id = same as above
    aws_secret_access_key = same as above


Policies assigned to IAM user

STS Policy

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "AssumeRole",
                "Effect": "Allow",
                "Action": [
                    "sts:AssumeRole"
                ],
                "Resource": [
                    "arn:aws:iam::*:role/hc/hc-master"
                ]
            }
        ]
    }



User Policy

    {
        "Statement": [
            {
                "Action": [
                    "iam:*AccessKey*",
                    "iam:*MFA*",
                    "iam:*SigningCertificate*",
                    "iam:UpdateLoginProfile*",
                    "iam:RemoveUserFromGroup*"
                ],
                "Effect": "Allow",
                "Resource": [
                    "arn:aws:iam::~183:mfa/${aws:username}",
                    "arn:aws:iam::~183:mfa/*/${aws:username}",
                    "arn:aws:iam::~183:mfa/*/*/${aws:username}",
                    "arn:aws:iam::~183:mfa/*/*/*${aws:username}",
                    "arn:aws:iam::~183:user/${aws:username}",
                    "arn:aws:iam::~183:user/*/${aws:username}",
                    "arn:aws:iam::~183:user/*/*/${aws:username}",
                    "arn:aws:iam::~183:user/*/*/*${aws:username}"
                ],
                "Sid": "Write"
            },
            {
                "Action": [
                    "iam:*Get*",
                    "iam:*List*"
                ],
                "Effect": "Allow",
                "Resource": [
                    "*"
                ],
                "Sid": "Read"
            },
            {
                "Action": [
                    "iam:CreateUser*",
                    "iam:UpdateUser*",
                    "iam:AddUserToGroup"
                ],
                "Effect": "Allow",
                "Resource": [
                    "*"
                ],
                "Sid": "CreateUser"
            }
        ],
        "Version": "2012-10-17"
    }

Force MFA Policy

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "BlockAnyAccessOtherThanAboveUnlessSignedInWithMFA",
                "Effect": "Deny",
                "NotAction": "iam:*",
                "Resource": "*",
                "Condition": {
                    "BoolIfExists": {
                        "aws:MultiFactorAuthPresent": "false"
                    }
                }
            }
        ]
    }


`main.tf`

    provider "aws" {
      profile                 = "GEHC-056"
      shared_credentials_file = "${pathexpand("~/.aws/config")}"
      region                  = "${var.region}"
    }

    data "aws_iam_policy_document" "test" {
      statement {
        sid    = "TestAssumeRole"
        effect = "Allow"

        actions = [
          "sts:AssumeRole",
        ]

        principals = {
          type = "AWS"

          identifiers = [
            "arn:aws:iam::~183:role/hc-devops",
          ]
        }

        sid    = "BuUserTrustDocument"
        effect = "Allow"

        principals = {
          type = "Federated"

          identifiers = [
            "arn:aws:iam::~875:saml-provider/ge-saml-for-aws",
          ]
        }

        condition {
          test     = "StringEquals"
          variable = "SAML:aud"
          values   = ["https://signin.aws.amazon.com/saml"]
        }
      }
    }

    resource "aws_iam_role" "test_role" {
      name               = "test_role"
      path               = "/"
      assume_role_policy = "${data.aws_iam_policy_document.test.json}"
    }


Get Caller Identity

    bash-4.4$ aws --profile GEHC-056 sts get-caller-identity
    Enter MFA code for arn:aws:iam::772660252183:mfa/503072343:
    {
      "UserId": "AROAIWCCLC2BGRPQMJC7U:botocore-session-1537474244",
      "Account": "730993910069",
      "Arn": "arn:aws:sts::730993910069:assumed-role/hc-master/botocore-session-1537474244"
    }


And the error...

    bash-4.4$ terraform plan
    Refreshing Terraform state in-memory prior to plan...
    The refreshed state will be used to calculate this plan, but will not be
    persisted to local or remote state storage.


    Error: Error refreshing state: 1 error(s) occurred:

    * provider.aws: Error creating AWS session: AssumeRoleTokenProviderNotSetError: assume role with MFA enabled, but AssumeRoleTokenProvider session option not set.

[⁞ Fernando Miguel]

Take a look at aws-vault 

It simplifies all the roles for you 

Here's a bit of sample code to setup the provider 

https://github.com/FernandoMiguel/kb/blob/master/PortoLinux/ET-2017Dez/terraform/main.tf

Hop on hangops slack and I can try to help you with more details 

--
Fernando Miguel

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/hashicorp/terraform/issues
IRC: #terraform-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Terraform" group.
To unsubscribe from this group and stop receiving emails from it, send an email to terraform-too...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/terraform-tool/486080a6-4a21-4fa0-bdd4-26772bb11bce%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[laxman Singh Rathore]

Hi jd,

Seems like bug:

https://github.com/terraform-providers/terraform-provider-aws/issues/5592

Laxman Singh

To view this discussion on the web visit https://groups.google.com/d/msgid/terraform-tool/CAM7yfUBb2AfXP9fuN1YHk%2BNT5Qax68H1WxeKt-4%3DAH94mSjf1w%40mail.gmail.com.

For more options, visit https://groups.google.com/d/optout.

--

Thanks & Regards
Laxman Singh Mandloi