Feature/permissions boundary (#27)

* Add support for permissions boundaries

* Add support for permissions boundaries

* Force MFA and remove hard coded value

Author: npalm

modules/setup-iam-permissions/main.tf

@@ -14,7 +14,7 @@ resource "aws_iam_policy" "boundary" {
   path = "/${var.namespaces.boundary_namespace}/"
 
   policy = templatefile("${path.module}/policies/boundary.json", {
-    role_namespace = "terraform"
+    role_namespace = var.namespaces.role_namespace
     account_id     = data.aws_caller_identity.current.account_id
   })
 }

modules/setup-iam-permissions/policies/assume-role-for-account.json

@@ -5,7 +5,12 @@
       "Action": "sts:AssumeRole",
       "Principal": { "AWS": "arn:aws:iam::${account_id}:root" },
       "Effect": "Allow",
-      "Sid": ""
+      "Sid": "",
+      "Condition": {
+        "Bool": {
+          "aws:MultiFactorAuthPresent": "true"
+        }
+      }
     }
   ]
 }