Terraform can bypass MFA constraint on AWS IAM

Question

I use Terraform to manage AWS Resources.

Terraform calls an administrative IAM User who has been MFA locked. But the terraform apply and terraform destroy commands from my local computer succeed without inputting a unique authentication code.

So, does Terraform bypass the multi-factor authentication?

Answer 1

Terraform is usually setup using API credentials. By default, MFA does not apply to API calls. You should setup and assume a role provisioned exclusively for this if you would like to enable multi-factor authentication on API calls for specific requests (TerminateInstances for example).

For more information, see:

AWS Blog: How to Enable MFA Protection on Your AWS API Calls

Terraform Documentation: AWS