terraformで二段階認証を使用する


# 目的
- terraform実行時、任意のロールに権限委譲したうえで、任意のユーザのMFAで生成されたワンタイムキーを要求させる

# 前提
- [Authenticator](https://chrome.google.com/webstore/detail/authenticator/bhghoamapcdpbohphigoooaddinpkbai?hl=ja)を使用して2段階認証コードを生成している

# 環境
- terraform

```bash
$ terraform version
Terraform v1.0.5
on darwin_amd64
```

- MacOS

```bash
$ sw_vers
ProductName:	Mac OS X
ProductVersion:	10.15.7
BuildVersion:	19H2
```
- awscli

```bash
$ aws --version
aws-cli/2.1.38 Python/3.8.8 Darwin/19.6.0 exe/x86_64 prompt/off
```

# 方法
- terraformは標準でMFAをサポートしていないので、[AWS VAULT](https://aws.amazon.com/jp/free/?trk=ps_a134p000003yhoVAAQ&trkCampaign=acq_paid_search_brand&sc_channel=ps&sc_campaign=acquisition_JP&sc_publisher=google&sc_category=core-main&sc_country=JP&sc_geo=JP&sc_outcome=devadopt&sc_detail=%2Bamazon%20%2Bweb%20%2Bservices&sc_content=Brand_amazon_web_services_bmm&sc_matchtype=b&sc_segment=487544183035&sc_medium=ACQ-P|PS-GO|Brand|Desktop|SU|Core-Main|Core|JP|EN|Text|dx&ef_id=Cj0KCQjwpf2IBhDkARIsAGVo0D0MUka_8z7oXk5O-buGMumntlRop-9_lR4f_8i5X24htUKmCInthv8aAptiEALw_wcB:G:s&s_kwcid=AL!4422!3!487544183035!b!!g!!%2Bamazon%20%2Bweb%20%2Bservices&gclid=Cj0KCQjwpf2IBhDkARIsAGVo0D0MUka_8z7oXk5O-buGMumntlRop-9_lR4f_8i5X24htUKmCInthv8aAptiEALw_wcB&all-free-tier.sort-by=item.additionalFields.SortRank&all-free-tier.sort-order=asc&awsf.Free%20Tier%20Types=*all&awsf.Free%20Tier%20Categories=*all)を使用する

# 設定
## install

```bash
$ brew install --cask aws-vault
```

## Roles and MFA
- ~/.aws/config

```bash
[profile <profile_name>]
region=<region-name>
source_profile=default
mfa_serial=arn:aws:iam::<account>:mfa/<user-name>
role_arn=arn:aws:iam::<account>:role/<role-name>
```

keychainに自分のIAMUSERのKEYを登録し、任意のパスワードを設定する

```bash
$ aws-vault add default
Enter Access Key ID: ********************
Enter Secret Access Key:****************************************
Added credentials to profile "default" in vault
```

- 初期化

```bash
$ aws-vault exec <profile-name> -- terraform init
```

- 登録したパスワードを入力
![スクリーンショット 2021-08-20 17.19.23.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/58788/be5c471e-397d-d9d6-c012-742695dff52a.png)


- 生成されたトークンを入力

```bash
 $ aws-vault exec <profile-name> -- terraform init
Enter token for arn:aws:iam::<account>:mfa/<user-name>: ******
```

- セッションの残時間などが可視化される

```bash
$ aws-vault list
Profile                      Credentials              Sessions
=======                      ===========              ========
<profile_name>                -                        sts.AssumeRole:59m56s
```

## 補足
- aliasを作成し、引数としてterraformコマンドを渡す

```bash
~/.bash_profile
alias av='aws-vault exec terraform-mfa'
```

```bash
$ av -- terraform init
Enter token for arn:aws:iam::<account>:mfa/<user-name>: ******

Initializing the backend...

Initializing provider plugins...
- Reusing previous version of hashicorp/aws from the dependency lock file
- Using previously-installed hashicorp/aws v3.51.0

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
```