|
| 1 | +Configure a user in AWS IAM that is required to use MFA to connect to S3 |
| 2 | +==== |
| 3 | + |
| 4 | +> You want an IAM user who cannot directly access S3, but instead must assume a role (with MFA required) to access S3 buckets in the same AWS account. Create a configuration for AWS CLI that is supported in Cyberduck and Mountain Duck using the [S3 (Credentials from AWS Command Line Interface) connection profile](../protocols/s3/index.md#connecting-using-credentials-from-aws-command-line-interface) or use the [S3 (STS Assume Role) connection profile](../protocols/s3/index.md#connecting-using-assumerole-from-aws-security-token-service-sts) with no additional configuration. |
| 5 | +
|
| 6 | +:::{important} |
| 7 | +* Cyberduck [8.3.0](https://cyberduck.io/changelog/) or later required |
| 8 | +* Mountain Duck [5.2.0](https://mountainduck.io/changelog/) or later required |
| 9 | + ::: |
| 10 | + |
| 11 | +:::{note} |
| 12 | +No custom configuration required with *AWS S3 (STS Assume Role)* connection profile available from _Preferences… → Profiles_. |
| 13 | +::: |
| 14 | + |
| 15 | +## Create a bookmark in Cyberduck or Mountain Duck |
| 16 | + |
| 17 | +1. Open _Preferences… → Profiles_ in Cyberduck or Mountain Duck. |
| 18 | +2. Enable the *AWS S3 (STS Assume Role)* connection profile. |
| 19 | +3. Add a new [Bookmark](../cyberduck/bookmarks.md) in Cyberduck or Mountain Duck and choose *AWS S3 (STS Assume Role)* connection profile in the protocol dropdown. |
| 20 | + |
| 21 | +## Create a user with both access keys and a MFA device configured |
| 22 | + |
| 23 | +1. In AWS [IAM console](https://console.aws.amazon.com/iam/) create a new user. Do *not* grant this user any permissions for S3. |
| 24 | +2. In the _Security credentials_ tab, choose _Create access key_ and copy to the clipboard. |
| 25 | +3. Enter access key ID and secret access key in the bookmark. |
| 26 | +4. Assign a MFA device to the user in _Multi-factor authentication (MFA)_. |
| 27 | + |
| 28 | + :::{tip} |
| 29 | + To allow entering the code in Cyberduck or Mountain Duck when connecting, make sure to choose _Authenticator app_ or _Hardware TOTP token_ as a MFA device. Using Passkey MFA does not allow getting a numeric MFA code. |
| 30 | + ::: |
| 31 | +5. Copy the MFA device ARN to the clipboard. |
| 32 | + |
| 33 | +## Create IAM role allowing access to S3 enforcing the MFA requirement |
| 34 | + |
| 35 | +1. In AWS [IAM console](https://console.aws.amazon.com/iam/) create a new IAM role that has S3 permissions and requires MFA. The IAM role must have the trusted entity set to the previously created user's ARN. |
| 36 | + |
| 37 | + ```{code-block} json |
| 38 | + { |
| 39 | + "Version": "2012-10-17", |
| 40 | + "Statement": [ |
| 41 | + { |
| 42 | + "Effect": "Allow", |
| 43 | + "Principal": { |
| 44 | + "AWS": "arn:aws:iam::<ACCOUNT_ID>:user/<S3_USER>" |
| 45 | + }, |
| 46 | + "Action": "sts:AssumeRole", |
| 47 | + "Condition": { |
| 48 | + "Bool": { "aws:MultiFactorAuthPresent": "true" } |
| 49 | + } |
| 50 | + } |
| 51 | + ] |
| 52 | + } |
| 53 | + ``` |
| 54 | +
|
| 55 | +2. Copy the Role ARN to the clipboard. |
| 56 | +3. Attach a permission policy to the role that grants access to S3 such as the managed policy `AmazonS3FullAccess`. |
| 57 | +
|
| 58 | + ```{code-block} json |
| 59 | + { |
| 60 | + "Version": "2012-10-17", |
| 61 | + "Statement": [ |
| 62 | + { |
| 63 | + "Effect": "Allow", |
| 64 | + "Action": [ |
| 65 | + "s3:*" |
| 66 | + ], |
| 67 | + "Resource": "*" |
| 68 | + } |
| 69 | + ] |
| 70 | + } |
| 71 | + ``` |
| 72 | + |
| 73 | + Restrict the permissions as necessary. |
| 74 | +
|
| 75 | +## Add inline policy to allow the user to assume the role with `sts:AssumeRole` |
| 76 | +
|
| 77 | +1. Navigate to the previously added IAM user to attach the `sts:AssumeRole` permission as an inline policy. |
| 78 | +2. Add a permission policy for the user by choosing _Add permissions → Create inline policy_ in the _Permissions_ tab. In the policy editor opened, add the action `sts:AssumeRole` for the resource ARN referencing the IAM role `<S3-ROLE-NAME>` created previously allowing access to S3 with MFA. |
| 79 | +
|
| 80 | + ```{code-block} json |
| 81 | + { |
| 82 | + "Version": "2012-10-17", |
| 83 | + "Statement": [ |
| 84 | + { |
| 85 | + "Effect": "Allow", |
| 86 | + "Action": "sts:AssumeRole", |
| 87 | + "Resource": "arn:aws:iam::<Account ID>:role/S3-ROLE-NAME" |
| 88 | + } |
| 89 | + ] |
| 90 | + } |
| 91 | + ``` |
| 92 | +
|
| 93 | +## Connect to S3 using the bookmark |
| 94 | +1. When not already configured in the bookmark, enter the static AWS credentials for the user with the permission to assume the IAM role when prompted. |
| 95 | +
|
| 96 | + :::{image} _images/S3_AssumeRole_Login_Prompt.png |
| 97 | + :alt: Login Prompt |
| 98 | + :width: 400px |
| 99 | + ::: |
| 100 | +
|
| 101 | +2. Enter the MFA device identification when prompted. |
| 102 | +
|
| 103 | + :::{image} _images/S3_MFA_Device_Prompt.png |
| 104 | + :alt: MFA Device Prompt |
| 105 | + :width: 400px |
| 106 | + ::: |
| 107 | +
|
| 108 | + :::{tip} |
| 109 | + Enter the identification number of the MFA device that is associated with the user. The value is either the serial number for a hardware device |
| 110 | + (such as `<code>GAHT12345678</code>`) or an Amazon Resource Name (ARN) for a virtual device (such as `<code>arn:aws:iam::123456789012:mfa/device</code>`) |
| 111 | + ::: |
| 112 | +
|
| 113 | +3. Enter the one-time MFA code from your device when prompted. |
| 114 | +
|
| 115 | + :::{image} _images/S3_MFA_Code_Prompt.png |
| 116 | + :alt: MFA Code Prompt |
| 117 | + :width: 400px |
| 118 | + ::: |
| 119 | +
|
| 120 | +
|
| 121 | +:::{admonition} Troubleshooting |
| 122 | +:class: warning |
| 123 | +### `User: arn:aws:iam::<ACCOUNT_ID>:user/<USERNAME> is not authorized to perform: s3:ListAllMyBuckets because no identity-based policy allows the s3:ListAllMyBuckets action.` |
| 124 | +This error occurs when the user does not have permission to list all buckets in the account. Possibly no attempt to assume the role was made. |
| 125 | +
|
| 126 | +### `The security token included in the request is invalid.` |
| 127 | +The AWS access key ID and secret access key set for the bookmark are invalid. |
| 128 | +
|
| 129 | +### `MultiFactorAuthentication failed with invalid MFA one time pass code.` |
| 130 | +The one-time MFA code already expired or is invalid. |
| 131 | +::: |
| 132 | +
|
| 133 | +## Alternative: Using AWS CLI Configuration |
| 134 | +
|
| 135 | +Alternatively use the *[S3 (Credentials from AWS Command Line Interface) profile](../protocols/s3/index.md#connecting-using-credentials-from-aws-command-line-interface)* to read values from the AWS CLI `~/aws/credentials` file. |
| 136 | +
|
| 137 | +1. Copy the Access Key ID and Secret Access Key to a profile in `~/.aws/credentials` |
| 138 | +
|
| 139 | + ```{code-block} properties |
| 140 | + [<S3_USER>] |
| 141 | + aws_access_key_id=AKIA… |
| 142 | + aws_secret_access_key=… |
| 143 | + ``` |
| 144 | +
|
| 145 | +2. Copy the MFA ARN and reference it in the `mfa_serial` parameter in the `<S3-ROLE-NAME>` profile in `~/.aws/credentials`. This will require the user to enter a MFA code when assuming a role with a S3 access policy attached when connecting. |
| 146 | + ```{code-block} properties |
| 147 | + [<S3-ROLE-NAME>] |
| 148 | + source_profile=<S3_USER> |
| 149 | + role_arn=arn:aws:iam::<Account ID>:role/<S3-ROLE-NAME> |
| 150 | + mfa_serial=arn:aws:iam::<Account ID>:mfa/<MFA-DEVICE-NAME> |
| 151 | + ``` |
| 152 | +
|
| 153 | +3. Enter the alias `<S3-ROLE-NAME>` for the role configuration from your AWS CLI configuration in _Server_ of the bookmark. |
| 154 | +
|
| 155 | +
|
| 156 | +## Alternative: Use Custom Connection Profile |
| 157 | +
|
| 158 | +1. Add the `role_arn` and `mfa_serial` to a [custom connection profile](../protocols/profiles/index.md) to skip the prompts on connect. |
| 159 | + ```{code-block} |
| 160 | + <key>Role Configurable</key> |
| 161 | + <true/> |
| 162 | + <key>Multi Factor Configurable</key> |
| 163 | + <true/> |
| 164 | + <key>Properties</key> |
| 165 | + <dict> |
| 166 | + <!-- Can be left blank to require Role ARN input from user --> |
| 167 | + <key>role_arn</key> |
| 168 | + <string>arn:aws:iam::<Account ID>:role/<S3-ROLE-NAME></string> |
| 169 | + <!-- Can be left blank to require MFA ARN input from user when assuming role requires token from MFA --> |
| 170 | + <key>mfa_serial</key> |
| 171 | + <string>arn:aws:iam::<Account ID>:mfa/<MFA-DEVICE-NAME></string> |
| 172 | + </dict> |
| 173 | + ``` |
| 174 | + |
| 175 | +## References |
| 176 | +
|
| 177 | +- [Assuming a Role](https://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html). |
0 commit comments