AWS IAM
1. Open the IAM console: Go to the AWS Management Console, navigate to the IAM service, and click on "Policies" in the left-hand menu.
2. Create a new policy: Click on "Create policy" to create a new policy.
3. Choose a policy type: Select "JSON" as the policy type.
4. Define the policy: In the JSON editor, define the policy. Paste the JSON contents of the file "IAMpolicy_Force_MFA.json" to define the policy.
5. Review and save the policy: Review your policy, give it a name and click "Create policy" to save it. 
6. (Optional, Lambda functions will handle this step using the name used on step 5 for the policy) Attach the policy to users or groups in IAM. 

NOTE: This will require them to use MFA when they log in to the AWS Management Console or when accessing certain AWS resources.


AWS SNS
1. Log in to the AWS Management Console with your AWS account.
2. Navigate to the AWS SNS service.
3. Click on "Create Topic" and provide a name for the topic. For example, "MFA Enforcement Alerts". You can also optionally set display names, encryption settings, and other configurations as needed.
4. Click on "Create Topic" to create the SNS topic.
5. Click on "Create subscription" and select the desired protocol for your subscribers, such as email, SMS, or AWS Lambda. 
6. Follow the on-screen instructions to provide the necessary details for each subscriber, such as email addresses, phone numbers, or Lambda function ARNs. 
7. Click on "Create subscription" to add the subscribers to the SNS topic.
8 (Optional, Lambda functions will hanlde this step) Test the integration between the MFA enforcement Lambda functions and the SNS topic to ensure 
that notifications are being sent as expected. You can manually trigger the Lambda functions or perform actions that should trigger the notifications, 
and then verify that the subscribers are receiving the notifications and that they contain the relevant information.

NOTE: Regularly monitor and manage the SNS topic and notifications to ensure that they are working correctly and meeting your requirements. 
You can use the SNS service in the AWS Management Console to view the status of notifications, configure settings such as message retention, 
message delivery status, and access control, and troubleshoot any issues that may arise.


AWS SES 
1. Log in to the AWS Management Console with your AWS account.
2. Navigate to the AWS SES service.
3. Click on "Verified identities" under the Configuration sub-menu.
4. Click on "Create Identity".
5. Choose either "Domain" or "Email address" based on your needs, the lambda functions currently use a register email, which is what we will use.
6. Enter an email address in the "Email address" field.
7. Click on "Create Identity".
8. Follow the instructions provided by AWS to verify the email for SES use.


AWS CloudTrail
1. Log in to the AWS Management Console with your AWS account.
2. Navigate to the AWS CloudTrail service.
3. Click on "Create trail".
4. Give your trail a name.
5. Choose the S3 bucket where you want to store your CloudTrail logs.
5a. If you don't have an S3 bucket, you can create one by clicking on the "Create a new S3 bucket" button.
6. Choose the AWS services that you want to log. For our MFA enforcement you will select login.
7. Choose the log file format. You can choose either JSON or AWS CloudTrail log format.
8. Enable log file encryption if you want to encrypt your CloudTrail logs at rest.
9. Choose the IAM role that CloudTrail will use to create logs. You can create a new IAM role or choose an existing one.
10. Review your trail settings and click on "Create trail".

NOTE: Once your trail is created, you can start viewing your CloudTrail logs in the S3 bucket that you specified.


AWS Lambda
1. Log in to the AWS Management Console with your AWS account.
2. Navigate to the AWS Lambda service.
3. Click on "Create function".
4. Choose "Author from scratch".
5. Enter a name for your function in the "Function Name" field.
6. Choose a runtime. For example, you can choose "Python 3.9/Python 3.10” if you plan to write your function in Python.
7. Choose the execution role for your function. You can either create a new role or choose an existing one.
8. Click "Create function".
9. Add the code (lambda_mfa-enforce-users.py) for your Lambda function in the editor.
10. Once you've finished adding the code, click "Deploy" to save the Lambda function.
11. Test your function by invoking it with a test event. You can create a test event by clicking on the "Test" button in the Lambda function console.
12. Repeat steps 3 through 11 using the code from (lambda_mfa-enforce-login.py).

NOTE: Be sure to replace and use the verified email created in the AWS SES section for the source email options of both lambda functions (lambda_mfa-enforce-users.py, lambda_mfa-enforce-login.py).
NOTE: Be sure to change name of the policy used in the (lambda_mfa-enforce-login.py) function to match the name of your policy created in AWS IAM section.


AWS CloudWatch
1. Log in to the AWS Management Console with your AWS account.
2. Navigate to the AWS CloudWatch service.
3. Click on "Events" in the left-hand menu.
4. Click on "Create rule".
5. In the "Event Source" section, select "Schedule".
6. Choose the schedule you want to use to trigger your Lambda function. For example, you can choose to run your function once per day, or every hour.
7. In the "Targets" section, select "Lambda function".
8. Choose the Lambda function you created for MFA enforcement (lambda_mfa-enforce-users.py).
9. Click "Configure details".
10. Give your CloudWatch event a name and description.
11. Click "Create rule".
12. Repeat steps 3 and 4.
13. In the "Event Source" section, select "Event Pattern".
14. In the "Service Name" section, type or select, "AWS Console Sign-in".
15. In the "Event Type" section, type or select, "All Events".
16. In the "Targets" section, select "Lambda function."
17. Choose the second Lambda function you created for MFA enforcement (lambda_mfa-enforce-login.py).
18. Click "Configure details".
19. Give your CloudWatch event a name and description.
20. Click "Create rule".