0

I created a new policy to enforce IAM user to setup MFA using the policy in this link https://docs.aws.amazon.com/en_pv/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage.html

Now the IAM user has AdministratorAccess already..so now with applying this force MFA policy now the user has 2 policies attached. The AWS managed policy AdministratorAccess and the new Managed policy i created Force_MFA

now when i try to run ansible iwth module https://docs.ansible.com/ansible/latest/modules/sts_assume_role_module.html that normally worked before attaching the Force_MFA policy now i get error that says i can not assume role of other accounts. When i remove the Force_MFA policy then it works again.

Where is the problem coming from. Is this issue with the policy or with ansible? Is this Force_MFA policy not working as expected? It supposed to let me do other things if MFA is enabled but in asnible it does not but in GUI i can switch roles and it works fine. Just that ansible playbooks now fail and complain i cant assume role.

Mind you i already enabled MFA for this IAM user and i can assume and switch accounts in dashboard BUT when i try to do that in ansible i get boto error saying i can not assume role

Any help will be appreciated.

If you need to post anything to help let me know and i will post.

uberrebu
  • 3,597
  • 9
  • 38
  • 73
  • (disclaimer: I am not familiar at all with your cloud provider, I just read the documentation). Since it seems you activated a feature to force Multi Factor Authentication, did you modify your `sts_assume_role` module call to integrate the `mfa_serial_number` and `mfa_token` options ? – Zeitounator Oct 13 '19 at 08:51
  • i thought MFA is only for console login? yes i did see the mfa serial number an dtoken option for the sts_assume_role...never even realized those options exist...so thanks for bringing those up. yeah this MFA thing is a bit tricky because i thought ther are only meant for console login only..didnt realize it aks for mfa token even with cli in the case of ansible – uberrebu Oct 13 '19 at 13:23
  • yes you are right...i add to add `mfa_serial_number` and `mfa_token` options and it worked! – uberrebu Oct 14 '19 at 04:53

1 Answers1

0

According to comment made by @Zeitounator i add to add mfa_serial_number and mfa_token options as required for the sts_assume_role here

worked after that

uberrebu
  • 3,597
  • 9
  • 38
  • 73