This document describes how to require MFA before allowing API calls for your sub-account before API calls are allowed when the sub-account requests an API.
Scenarios
This document describes how to use a custom policy in Tencent Cloud Access Management (CAM) to restrict identities that have not passed MFA multi-factor authentication from requesting sensitive API operations. By adding the MFA condition key "qcs:mfaPresent" to a policy, you can require users to complete MFA device authentication before calling APIs, improving account security.
Typical scenario examples:
MFA authentication is required when a role is assumed across accounts.
Restrict users who have not bound MFA from terminating Cloud Virtual Machine (CVM) instances.
Protect sensitive operations (for example, deleting COS buckets or changing database passwords).
Prerequisites
Service support: The target API operation must support the qcs:mfaPresent condition key. For details, see CAM-Enabled API (the scope of APIs supporting qcs:mfaPresent is the same as that of APIs supporting IP address restrictions). Important Notes
MFA device restrictions
For API calls, only virtual MFA devices are supported (for example, Google Authenticator, Microsoft Authenticator, and the Tencent Cloud Assistant mini program). Phone number verification codes and WeChat QR code verification are not currently supported.
When logging in from the console, you must enable login protection. Login protection supports multiple verification methods, including virtual MFA, phone number verification codes, and WeChat QR code verification.
Operation Steps
Step 1: Bind a Virtual MFA Device and Enabling Login Protection
1. Administrator operations
Check the user's MFA binding status and ensure that MFA is bound.
Ensure that sub-users with console access have login protection enabled, which requires MFA code verification during login.
2. Sub-user operations
Sub-users who have bound a virtual MFA device should log in to the Tencent Cloud console and enter the MFA code by following the instructions to complete identity verification. Step 2: Administrator Creating an MFA Protection Policy
1. Policy syntax
The following is a sample policy (to restrict termination of CVM instances):
{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": "cvm:TerminateInstances",
"resource": "*",
"condition": {
"bool_equal": {
"qcs:mfaPresent": "true"
}
}
}
]
}
2. Policy association
Associate the policy with the target user/user group to ensure that the permissions take effect. For detailed authorization instructions, see Authorization Management. Step 3: Call MFA-Supported APIs
Sub-users must obtain temporary credentials and call APIs in one of the following ways:
Method 1: GetSessionToken (Obtaining Temporary MFA Credentials)
Applicable scenarios: API operations protected by policies in the current account (for example, COS bucket deletion).
API call example:
curl -X POST <https://sts.tencentcloudapi.com> \\
-H "Authorization: TC3-HMAC-SHA256 ..." \\
-d '{
"Action": "GetSessionToken",
"Name": "temp_token",
"Policy": "{\\"version\\":\\"2.0\\", ...}",
"SerialNumber":"qcs::cam::uin/12345678:mfa/softToken", # Enter the virtual MFA serial number.
"MfaCode": "123456" # Enter the virtual MFA code.
}'
Use Case
Scenario: Verify MFA before force deleting a COS bucket
1. Policy configuration
{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": "cos:DeleteBucket",
"resource": "qcs::cos:ap-guangzhou:uid/12345678:bucket/example-1250000000/*",
"condition": {
"bool_equal": {
"qcs:mfaPresent": "true"
}
}
}
]
}
2. User operations
Call the GetSessionToken API to obtain temporary credentials (with the MFA code required). Use the temporary credentials to call the cos:DeleteBucket API to delete the bucket.
Warning:
The examples are for demonstration only. Replace the "effect", "action", "resource", and other information in the policy based on your use case. Avoid accidentally deleting COS buckets, which can cause business losses.
Method 2: AssumeRole
Applicable scenarios: Cross-account access or role delegation.
API call example:
curl -X POST <https://sts.tencentcloudapi.com> \\
-H "Authorization: TC3-HMAC-SHA256 ..." \\
-d '{
"Action": "AssumeRole",
"RoleArn": "qcs::cam::uin/12345678:role/TestRole",
"RoleSessionName": "test",
"DurationSeconds": 7200,
"SerialNumber":"qcs::cam::uin/12345678:mfa/softToken", # Enter the virtual MFA serial number.
"MfaCode": "123456" # Enter the virtual MFA code.
}'