Create IAM account with CloudFormation

Question

I want to create an AWS IAMS account that has various permissions with CloudFormation.

I understand there are policies that would let a user change his password and let him get his account to use MFA here

How could I enforce the user to use MFA at first log in time when he needs to change the default password?

This is what I have:

The flow I have so far is:

1. User account is created
2. When user tries to log in for the first time is asked to change the default password.
3. User is logged in the AWS console.

Expected behavior:

1. User account is created
2. When user tries to log in for the first time is asked to change the default password and set MFA using Authenticator app.
3. User is logged in the AWS console and has permissions.

A potential flow is shown here . Is there another way?

Update:

This blog explains the flow Again, is there a better way? Like an automatic pop up that would enforce the user straight away?

Update2:

I might have not been explicit enough. What we have so far it is an ok customer experience. This flow would be fluid

1. User tries to log in

2. Console asks for password change

3. Colsole asks for scanning the code and introducing the codes

4. User logs in with new password and the code from authenticator 5.User is not able to deactivate MFA

Answer 1

Allow users to self manage MFA is the way to go, if you are using regular IAM. You can try AWS SSO, it's easier to manage and free.

Allowing users to login, change password, setup MFA and Denying everything other than these if MFA is not setup as listed here

We could create an IAM Group with an inline policy and assign users to that group. This is CF for policy listed in the docs.

Resources:
  MyIamGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: My-Group
  MyGroupPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - iam:GetAccountPasswordPolicy
              - iam:GetAccountSummary
              - iam:ListVirtualMFADevices
              - iam:ListUsers
            Effect: Allow
            Resource: "*"
          - Action:
              - iam:ChangePassword
              - iam:GetUser
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - :iam::1234567891111:user/${aws:username}
          - Action:
              - iam:CreateVirtualMFADevice
              - iam:DeleteVirtualMFADevice
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - :iam::1234567891111:mfa/${aws:username}
          - Action:
              - iam:DeactivateMFADevice
              - iam:EnableMFADevice
              - iam:ListMFADevices
              - iam:ResyncMFADevice
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - :iam::1234567891111:user/${aws:username}
          - NotAction:
              - iam:CreateVirtualMFADevice
              - iam:EnableMFADevice
              - iam:GetUser
              - iam:ListMFADevices
              - iam:ListVirtualMFADevices
              - iam:ListUsers
              - iam:ResyncMFADevice
              - sts:GetSessionToken
            Condition:
              BoolIfExists:
                aws:MultiFactorAuthPresent: "false"
            Effect: Deny
            Resource: "*"
      PolicyName: My-Group-Policy
      Groups:
        - Ref: MyIamGroup

Answer 2

I think this is the way to go and one could extract the knowledge of creating users with whatever permissions he wants after the user sets up the MFA.

The policy template it is useful.

instructions