使用 AWS CDK 创建受 MFA 保护的角色会绕过 MFA 条件

Question

I am trying to create an MFA-protected role granting AdministratorAccess which can be assumed by another user. I can get it to define the user and the permission policy of the role. However, when I define the MFA requirement, the principal and the permitted action is duplicated in the permission policy, which renders the MFA requirement condition useless.

My CDK code looks like this:

from aws_cdk import (
    aws_iam as iam,
    core,
)


class AssumeRoleStack(core.Stack):

    def __init__(self, scope: core.Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

        user = iam.User(self, 'myuser')
        role = iam.Role(self, 'myrole',
                        assumed_by=iam.ArnPrincipal(user.user_arn),
                        max_session_duration=core.Duration.hours(8))
        role.add_managed_policy(iam.ManagedPolicy.from_aws_managed_policy_name('AdministratorAccess'))
        role.assume_role_policy.add_statements(
            iam.PolicyStatement(principals=[user],
                                actions=['sts:AssumeRole'],
                                conditions={'Bool': {'aws:MultiFactorAuthPresent': True}})
        )
        user.add_to_policy(iam.PolicyStatement(actions=['sts:AssumeRole'], resources=[role.role_arn]))

The resulting permission policy of the role then looks as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::012345678910:user/assume-role-myuserZ09A543B-1ULCILBM447SF"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::012345678910:user/assume-role-myuserZ09A543B-1ULCILBM447SF"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

This is not what I want, because - as mentioned above - the user will be able to assume the role even without MFA present. What I want is the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::012345678910:user/assume-role-myuserZ09A543B-1ULCILBM447SF"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

I already tried defining the role without the assumed_by argument and adding the principal in the assume_role_policy instead, but a principal is required by the iam.Role class. Similarly, iam.PolicyStatement in assume_role_policy.add_statements() does not allow leaving out either the principals or the actions argument.

How can I create the role's permission policy without redundancies and without rendering conditions useless because of them?

Answer 1

It looks like there is no way to update the existing trust policy. You can possibly raise an issue on Github .

As a workaround, you can set AccountRootPrincipal as the trusted principal when defining the role, so the user cannot assume it without MFA.

iam.Role(
   assumed_by=iam.AccountRootPrincipal()
)

Answer 2

I figured it out now. The solution is a combination of the one proposed by @Vikyol and the hints by the kind people over at this Github issue :

You have to create a class that inherits from iam.AccountRootPrincipal and overrides the property policy_fragment so that the returned trust policy contains the Conditions block:

from aws_cdk import (
    aws_iam as iam,
    core,
)


class MFAAccountRootPrincipal(iam.AccountRootPrincipal):
    def __init__(self):
        super().__init__()

    @property
    def policy_fragment(self) -> iam.PrincipalPolicyFragment:
        return iam.PrincipalPolicyFragment(
            principal_json={'AWS': [self.arn]},
            conditions={'Bool': {'aws:MultiFactorAuthPresent': True}}
        )


class AssumeRoleStack(core.Stack):
    def __init__(self, scope: core.Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

        user = iam.User(self, 'myuser')
        role = iam.Role(self, 'MFA_Admin_Role',
                        assumed_by=MFAAccountRootPrincipal(),
                        managed_policies=[iam.ManagedPolicy.from_aws_managed_policy_name('AdministratorAccess')],
                        max_session_duration=core.Duration.hours(8))
        user.add_to_policy(iam.PolicyStatement(actions=['sts:AssumeRole'], resources=[role.role_arn]))

Note that this doesn't allow for trusting accounts other than the one where the user & role are defined. However, this can be solved easily by passing an account number or instance of core.Environment as an argument to the AssumeRoleStack initializer. Passing this down to the initializer of MFAAccountRootPrincipal you can then manually construct the ARN of the trusted account's root user.

Answer 3

Why invent your own methods when the capability exists in CDK natively?

role = iam.Role(
    self,
    "RoleWithCondition",
    description="Role insisting on MFA",
    assumed_by=iam.PrincipalWithConditions(
        principal=iam.AccountPrincipal("123456789012").grant_principal,
        conditions={
            "Bool":  {
                "aws:MultiFactorAuthPresent": True,
            },
        },
    ).grant_principal
)