provider/aws: Remove IAM user's MFA devices with force_destroy #5908

[rhenning]

When force_destroy was specifed on an aws_iam_user resource, only IAM
access keys and the login profile were destroyed. If a mutli-factor auth
device had been activated for that user, deletion would fail as follows:

* aws_iam_user.testuser1: Error deleting IAM User testuser1: DeleteConflict: Cannot delete entity, must delete MFA device first.
    status code: 409, request id: aa41b1b7-ac4d-11e6-bb3f-3b4c7a310c65

This commit iterates over any of the user's MFA devices and deactivates
them before deleting the user. It follows a pattern similar to that used
to remove users' IAM access keys before deletion.

The code seems to "work", in the sense that I've run the existing acceptance
tests and have tested that IAM users with active MFA devices are now destroyed
without receiving an error, but I could use some guidance on the appropriate
amount of test coverage and strategy here. I figured better to get some eyes on
it before doing anything else. Thanks!

$ make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSUser_'
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2016/11/20 17:09:00 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSUser_ -timeout 120m
=== RUN   TestAccAWSUser_importBasic
--- PASS: TestAccAWSUser_importBasic (5.70s)
=== RUN   TestAccAWSUser_basic
--- PASS: TestAccAWSUser_basic (11.12s)
PASS
ok  	github.com/rhenning/terraform/builtin/providers/aws	 20.840s

[jen20]

Thanks for the pull request @rhenning! I hit this exact issue the other day, and can definitely confirm it is a bug. I'll review this tomorrow and get it merged in.

[stack72]

This LGTM! Just ran the tests and it all looks good - thanks for the work here @rhenning

% make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSUser_'                    130 ↵
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2016/11/21 10:13:45 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSUser_ -timeout 120m
=== RUN   TestAccAWSUser_importBasic
--- PASS: TestAccAWSUser_importBasic (18.75s)
=== RUN   TestAccAWSUser_basic
--- PASS: TestAccAWSUser_basic (40.74s)
PASS
ok  	github.com/hashicorp/terraform/builtin/providers/aws	59.508s

[rhenning]

Thanks for looking @stack72 and @jen20. Hashicorp and Terraform have done a lot for me. Glad I was able to give a tiny bit back!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.