Skip to main content

MFA Policy Enforcer

📦 Overview​

This Terraform module provisions an IAM policy that enforces Multi-Factor Authentication (MFA) for all IAM users, helping secure AWS accounts against unauthorized access.

✅ Key Features​

  • Denies AWS API access unless the request is MFA-authenticated
  • Customizable policy name and description
  • Helps enforce organization-wide IAM security standards
  • Tags for environment and usage tracking

💼 Use Cases​

  • Enforce mandatory MFA usage across all IAM users
  • Secure privileged IAM roles with least-privilege + MFA
  • Integrate with compliance frameworks such as CIS, NIST, and ISO
  • Harden IAM authentication layers in staging or production accounts

📥 Input Variables​

NameTypeDescription
regionstringAWS region for deployment
policy_namestringName for the IAM policy enforcing MFA
policy_descriptionstringDescription of the policy

📤 Outputs​

NameDescription
policy_nameName of the created IAM policy
policy_arnARN of the IAM policy for enforcement

🚀 Deployment Readiness​

  • ✅ Compatible with Terraform 1.0+
  • ✅ Requires AWS Provider 5.x+
  • 🔐 Requires iam:CreatePolicy permission

🛠️ Example Usage​

module "mfa_policy_enforcer_deployment" {
  source = "git::ssh://git@github.com/archiphire/aws-level-1-modules.git//identity/mfa-policy-enforcer?ref=v1.0.0"

  region             = "us-east-1"
  policy_name        = "EnforceMFAAccess"
  policy_description = "Enforces MFA for all IAM users in the account"
}
terraform init
terraform plan
terraform apply

or

tofu init
tofu plan
tofu apply

🧹 Cleanup​

Terraform Destroy:

terraform destroy

or

tofu destroy

Manual Deletion:

aws iam delete-policy --policy-arn arn:aws:iam::<account-id>:policy/EnforceMFAAccess

⚠️ If the policy is attached to users or groups, remove those attachments first to avoid lockout.

🛡️ Notes​

This is a Level 1 security module designed to enforce MFA across AWS accounts.
To activate the policy, attach it to IAM users, groups, or roles as required.
Make sure at least one user has recovery access in case MFA becomes misconfigured.

🔒 Deployment Package Notice​

This module is part of the Level 1 AWS License Tier.
To access the full deployment package and source code, subscribe to Archiphire.