How to enforce enable MFA for other users

You are correct, the user needs to see the QR code to setup the MFA device. There is no easy way apart from applying a policy to force users to register a MFA device before being able to carry out any other tasks

Apply this policy to all users/group and add users to the group whom you require to enforce MFA

If you apply this policy to the users, they will not be able to perform any tasks unless they have added MFA.

Once the user has added their MFA, ensure the user logs out and in again.

NOTE, this is for IAM users only. SSO has its own setting to enforce MFA

{
    "Statement": [
        {
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "false",
                    "aws:ViaAWSService": "false"
                }
            },
            "Effect": "Deny",
            "NotAction": [
                "iam:CreateVirtualMFADevice",
                "iam:DeleteVirtualMFADevice",
                "iam:ListVirtualMFADevices",
                "iam:EnableMFADevice",
                "iam:ResyncMFADevice",
                "iam:ListAccountAliases",
                "iam:ListUsers",
                "iam:ListSSHPublicKeys",
                "iam:ListAccessKeys",
                "iam:ListServiceSpecificCredentials",
                "iam:ListMFADevices",
                "iam:GetAccountSummary",
                "sts:GetSessionToken",
                "iam:GetAccountPasswordPolicy",
                "iam:ChangePassword"
            ],
            "Resource": "*",
            "Sid": "BlockMostAccessUnlessSignedInWithMFA"
        },
        {
            "Action": [
                "iam:CreateVirtualMFADevice"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::*:mfa/*",
            "Sid": "AllowManageOwnVirtualMFADevice"
        },
        {
            "Action": [
                "iam:DeactivateMFADevice",
                "iam:EnableMFADevice",
                "iam:ListMFADevices",
                "iam:ResyncMFADevice"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::*:user/${aws:username}",
            "Sid": "EnforceIAMMFA"
        }
    ],
    "Version": "2012-10-17"
}

To enforce Multi-Factor Authentication (MFA) for other users in AWS, you can follow these steps:

1. Sign in to the AWS Management Console using your own credentials.

2. Go to the IAM (Identity and Access Management) service.

3. In the left navigation pane, click on Users.

4. Select the user for whom you want to enforce MFA.

5. In the Security credentials tab, locate the Assigned MFA device section.

6. Click on the Manage link next to the Assigned MFA device.

7. In the Manage MFA Device wizard, select the Virtual MFA device option.

8. Provide instructions to the user on how to set up their MFA device (such as a virtual MFA app on their smartphone). They will need to download an authenticator app like Google Authenticator or Authy.

9. Once the user has set up their MFA device, they will need to scan the QR code using their MFA app or manually enter the secret key.

10. After the user has successfully set up their MFA device, click on Assign MFA.

By following these steps, you have now enforced MFA for the user. They will be required to use MFA when logging in to the AWS console. Repeat these steps for each user you want to enforce MFA for.

A quick question - what about IAM 'users' that are not actually humans, but just service control entities (I know it should be roles and resource-based permissions, but we are talking legacy solutions here). is there a policy I can add to the above to make sure that that affects only users trying to log in to the console? or is aws:ViaAWSService sufficient for this? I am weary of legacy 'iam accounts' whose sole purpose is to provide a key for some script somewhere, accessing s3 etc...