Ability to enable MFA for admins

[aiavci]

It would be nice to support MFA out of the box for admin users.

Currently admins need a strong password and email. An MFA option would make the authentication stronger

[PoeppingT]

We're already using Cognito UserPools to manage identities for the Admin UI, and MFA is supported for Cognito UserPools. We currently set the MFAConfiguration to "Off" in saas-boost-web.yaml, but this can be changed to "On" to enable MFA for all Admin UI users.

To completely enable this out of the box, a new parameter would need to be added both to the saas-boost-web.yaml CloudFormation template and the saas-boost.yaml CloudFormation template representing the MFA choice, very similar to how we pass the AdminEmailAddress today from the installer to the main Boost template to the Boost Web UI template. Ideally this would also be implemented with another choice during install time asking whether MFA should be enabled for Web UI users.

Just for good measure I also looked into whether it's possible to do "OPTIONAL" MFA for the UserPool and enabling MFA just for the Admin user at create time. There doesn't look to be a way to enable MFA using Cognito's CloudFormation UserPoolUser resource. The only way to enable MFA in an OPTIONAL UserPool is to enable it for an existing User using the SetUserMFAPreference API call, for which one would need to add an extra hook into the CloudFormation template to kick off a custom resource (we do something similar in saas-boost-metrics-analytics.yaml to configure the Redshift table) to call that API.

Best course of action would be to just provide an option to turn MFA on for all users. If Boost admins want to optionally enable MFA for some Admin UI users, the easiest way would be to manually alter the UserPool in their AWS console after creation and turn on MFA for each user that wants it.