chan9390 / aws-mfa-enforce Goto Github PK

Currently the implementation is : https://github.com/Chan9390/aws-mfa-enforce/blob/master/handler.js#L43

It checks for the PasswordLastUsed parameter and determines if the user has management console.

But it fails in the following scenario:

1. IAM user given both Management Console and Programmatic access
2. The Management Console access is then removed
3. This policy adds that IAM user with only Programmatic access to the MFAGroup since the PasswordLastUsed param is still present.