resource/aws_iam_user: Delete a user's virtual MFA devices when force_destroy is enabled

aws/resource_aws_iam_user.go

@@ -233,7 +233,11 @@ func resourceAwsIamUserDelete(d *schema.ResourceData, meta interface{}) error {
 			return fmt.Errorf("error removing IAM User (%s) SSH keys: %s", d.Id(), err)
 		}
 
-		if err := deleteAwsIamUserMFADevices(iamconn, d.Id()); err != nil {
+		if err := deleteAwsIamUserVirtualMFADevices(iamconn, d.Id()); err != nil {
+			return fmt.Errorf("error removing IAM User (%s) Virtual MFA devices: %s", d.Id(), err)
+		}
+
+		if err := deactivateAwsIamUserMFADevices(iamconn, d.Id()); err != nil {
 			return fmt.Errorf("error removing IAM User (%s) MFA devices: %s", d.Id(), err)
 		}
 
@@ -326,7 +330,45 @@ func deleteAwsIamUserSSHKeys(svc *iam.IAM, username string) error {
 	return nil
 }
 
-func deleteAwsIamUserMFADevices(svc *iam.IAM, username string) error {
+func deleteAwsIamUserVirtualMFADevices(svc *iam.IAM, username string) error {
+	var VirtualMFADevices []string
+	var err error
+
+	listVirtualMFADevices := &iam.ListVirtualMFADevicesInput{
+		AssignmentStatus: aws.String("Assigned"),
+	}
+	pageOfVirtualMFADevices := func(page *iam.ListVirtualMFADevicesOutput, lastPage bool) (shouldContinue bool) {
+		for _, m := range page.VirtualMFADevices {
+			if *m.User.UserName == username {
+				VirtualMFADevices = append(VirtualMFADevices, *m.SerialNumber)
+			}
+		}
+		return !lastPage
+	}
+	err = svc.ListVirtualMFADevicesPages(listVirtualMFADevices, pageOfVirtualMFADevices)
+	if err != nil {
+		return fmt.Errorf("Error removing Virtual MFA devices of user %s: %s", username, err)
+	}
+	for _, m := range VirtualMFADevices {
+		_, err := svc.DeactivateMFADevice(&iam.DeactivateMFADeviceInput{
+			UserName:     aws.String(username),
+			SerialNumber: aws.String(m),
+		})
+		if err != nil {
+			return fmt.Errorf("Error deactivating Virtual MFA device %s: %s", m, err)
+		}
+		_, err = svc.DeleteVirtualMFADevice(&iam.DeleteVirtualMFADeviceInput{
+			SerialNumber: aws.String(m),
+		})
+		if err != nil {
+			return fmt.Errorf("Error deleting Virtual MFA device %s: %s", m, err)
+		}
+	}
+
+	return nil
+}
+
+func deactivateAwsIamUserMFADevices(svc *iam.IAM, username string) error {
 	var MFADevices []string
 	var err error
 

aws/resource_aws_iam_user_test.go

@@ -139,7 +139,11 @@ func testSweepIamUsers(region string) error {
 			return fmt.Errorf("error removing IAM User (%s) SSH keys: %s", username, err)
 		}
 
-		if err := deleteAwsIamUserMFADevices(conn, username); err != nil {
+		if err := deleteAwsIamUserVirtualMFADevices(conn, username); err != nil {
+			return fmt.Errorf("error removing IAM User (%s) virtual MFA devices: %s", username, err)
+		}
+
+		if err := deactivateAwsIamUserMFADevices(conn, username); err != nil {
 			return fmt.Errorf("error removing IAM User (%s) MFA devices: %s", username, err)
 		}