AWS IAM Policies: require user to provision MFA themselves - amazon-web-services

Question

I'd like to send our new users their IAM username and temporary credentials and then require them to change their password AND require them to configure their own virtual MFA before they get access to anything else in the console.
1) When creating the user I can obviously generate a temporary password and require them to change it on first login. Security Credentials-->Manage Password-->'Require user to create a new password at next sign-in'.
2) The following policy will permit IAM users to change their own passwords:
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:ChangePassword",
"iam:GetAccountPasswordPolicy"
],
"Resource": "*"
}
}
3) The following policy allows users to manage only their own virtual mfa devices:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUsersToCreateEnableResyncDeleteTheirOwnVirtualMFADevice",
"Effect": "Allow",
"Action": [
"iam:CreateVirtualMFADevice",
"iam:EnableMFADevice",
"iam:ResyncMFADevice",
"iam:DeleteVirtualMFADevice"
],
"Resource": [
"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}",
"arn:aws:iam::account-id-without-hyphens:user/${aws:username}"
]
},
{
"Sid": "AllowUsersToDeactivateTheirOwnVirtualMFADevice",
"Effect": "Allow",
"Action": [
"iam:DeactivateMFADevice"
],
"Resource": [
"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}",
"arn:aws:iam::account-id-without-hyphens:user/${aws:username}"
],
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": true
}
}
},
{
"Sid": "AllowUsersToListMFADevicesandUsersForConsole",
"Effect": "Allow",
"Action": [
"iam:ListMFADevices",
"iam:ListVirtualMFADevices",
"iam:ListUsers"
],
"Resource": "*"
}
]
}
Using the three methods above I can require them to change their password and allow them to configure their own virtual MFA devices, I just don't know if there is a way to require them to configure an MFA.

Answer 1

AWS has a documented answer for this: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html
It's a single policy with several statements that:
Allows listing all users and all MFA devices.
Allows listing only your own user and their own MFA devices.
Allows managing your own MFA device.
Allow deactivating MFA if you have logged in with MFA.
Block access to everything else unless MFA was used for sign in.

Answer 2

I'm posting the complete solution because it is not a duplicate of Can you require MFA for AWS IAM accounts?, which is extremely helpful, but is not the complete solution to also allowing new IAM users to login to the console, change their password AND add their own virtual MFA by themselves.
1) Create a managed policy to allow users to change their own passwords:
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:ChangePassword",
"iam:GetAccountPasswordPolicy"
],
"Resource": "*"
}
}
2) Create a managed policy to allow users to manage their own virtual mfa devices:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUsersToCreateEnableResyncDeleteTheirOwnVirtualMFADevice",
"Effect": "Allow",
"Action": [
"iam:CreateVirtualMFADevice",
"iam:EnableMFADevice",
"iam:ResyncMFADevice",
"iam:DeleteVirtualMFADevice"
],
"Resource": [
"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}",
"arn:aws:iam::account-id-without-hyphens:user/${aws:username}"
]
},
{
"Sid": "AllowUsersToDeactivateTheirOwnVirtualMFADevice",
"Effect": "Allow",
"Action": [
"iam:DeactivateMFADevice"
],
"Resource": [
"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}",
"arn:aws:iam::account-id-without-hyphens:user/${aws:username}"
],
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": true
}
}
},
{
"Sid": "AllowUsersToListMFADevicesandUsersForConsole",
"Effect": "Allow",
"Action": [
"iam:ListMFADevices",
"iam:ListVirtualMFADevices",
"iam:ListUsers"
],
"Resource": "*"
}
]
}
3) Add the following condition to all policies where you want to require MFA:
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "ReadOnlyEC2RequireMFA",
"Action": [
"ec2:Describe*"
],
"Effect": "Allow",
"Resource": "*",
"Condition": {
"Null": {
"aws:MultiFactorAuthAge": "false"
}
}
}]
}
4) When you create new IAM users, and assign them a password, check the box 'Require user to create a new password at next sign-in' and apply the three managed policies above (or assign the managed policies to a group and add the user to the group).
Now distribute the username and temporary password to the new IAM user. When they login it will prompt them to change their password, then they will only be able to go into IAM, select their own user account and add their own MFA device. They will need to log off and log back in using MFA to get the ec2:Describe* permissions.