Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

device configuration Options are wrong #124

Open
xronz opened this issue Oct 2, 2023 · 0 comments
Open

device configuration Options are wrong #124

xronz opened this issue Oct 2, 2023 · 0 comments

Comments

@xronz
Copy link

xronz commented Oct 2, 2023

aws-cloudformation/cloudformation-coverage-roadmap#448 (comment)

device_configuration = lookup(local.device_configuration_default, "challenge_required_on_new_device") == false && lookup(local.device_configuration_default, "device_only_remembered_on_user_prompt") == false ? [] : [local.device_configuration_default]

### Due to the above statement assuming that both attributes are false, it is set to both attributes as null. 
### So the option was forced to be set as a "Don’t remember" Option.
### However, the following configuration should be "Always remember", Allow users to bypass MFA for trusted devices "NO"
device_configuration = {
    challenge_required_on_new_device      = false
    device_only_remembered_on_user_prompt = false
}


### These are the following combinations for device configuration:
### 1) "Don’t remember" Option
device_configuration = {
    challenge_required_on_new_device      = null
    device_only_remembered_on_user_prompt = null
}

### 2) "User opt-in", Allows users to bypass MFA for trusted devices "YES"  Option
device_configuration = {
    challenge_required_on_new_device      = true
    device_only_remembered_on_user_prompt = true
}

### 3) "User opt-in", Allows users to bypass MFA for trusted devices "NO"  Option
device_configuration = {
    challenge_required_on_new_device      = false
    device_only_remembered_on_user_prompt = true
}

### 4) "Always remember", Allow users to bypass MFA for trusted devices "NO"  Option
device_configuration = {
    challenge_required_on_new_device      = false
    device_only_remembered_on_user_prompt = false
}

### 5) "Always remember", Allow users to bypass MFA for trusted devices "YES"  Option
device_configuration = {
    challenge_required_on_new_device      = true
    device_only_remembered_on_user_prompt = false
}

### Modify "main.tf" file
### Commented the Line 40 device_configuration
# device_configuration
# dynamic "device_configuration" {
#   for_each = local.device_configuration
#   content {
#     challenge_required_on_new_device      = lookup(device_configuration.value, "challenge_required_on_new_device")
#     device_only_remembered_on_user_prompt = lookup(device_configuration.value, "device_only_remembered_on_user_prompt")
#   }
# }

### Replaced with the following as Hotfix
device_configuration {
    challenge_required_on_new_device      = try(var.device_configuration.challenge_required_on_new_device, null)
    device_only_remembered_on_user_prompt = try(var.device_configuration.device_only_remembered_on_user_prompt, null)
}
@xronz xronz changed the title device configuration Options is wrong device configuration Options are wrong Oct 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant