title: Unable to deactivate or delete aws iam mfa device
body: <p>I am AWS admin. I have followed the instructions to enforce MFA for all my users. One of my users receives an &quot;Entity Already exists&quot; error. The dialog asks the user to &quot;ask your administrator to delete the existing device using the CLI...&quot; That's me. I have had no luck doing this.</p>
  <p>If I use the CLI to list-virtual-mfa-devices I see this. The user in question is 'userBob'. As you can see the SerialNumber of his existing device shows up without the &quot;User&quot; attached.</p>
  <pre><code>{
      &quot;VirtualMFADevices&quot;: [
          {
              &quot;SerialNumber&quot;: &quot;arn:aws:iam::xxxxx:mfa/userBob&quot;
          },
          {
              &quot;SerialNumber&quot;: &quot;arn:aws:iam::xxxxxxxxx:mfa/root-account-mfa-device&quot;,
              &quot;User&quot;: {
                  &quot;UserName&quot;: &quot;mycompany&quot;,
                  &quot;UserId&quot;: &quot;xxxxx&quot;,
                  &quot;Arn&quot;: &quot;arn:aws:iam::xxxxxx:root&quot;,
                  &quot;CreateDate&quot;: &quot;2010-10-12T18:54:24+00:00&quot;,
                  &quot;PasswordLastUsed&quot;: &quot;2020-05-27T20:28:12+00:00&quot;
              },
              &quot;EnableDate&quot;: &quot;2020-05-19T19:06:11+00:00&quot;
          },
  </code></pre>
  <p>If I run this command:</p>
  <pre><code>aws iam deactivate-mfa-device --serial-number arn:aws:iam::xxxxxxxxx:mfa/userBob --user-name userBob
  </code></pre>
  <p>I get this error
  <strong>An error occurred (AccessDenied) when calling the DeactivateMFADevice operation: User: arn:aws:iam::xxxxxxx:user/meKevinAdminGuy is not authorized to perform: iam:DeactivateMFADevice on resource: user userBob with an explicit deny</strong></p>
  <p>I have certainly never placed an explicit deny on any iam actions. I have no way to find where the explicit deny is. I've given myself all iam permissions.</p>
  <p>Running the aws iam delete-virtual-mfa-device gives the same error. Can't deactivate it. Can't delete it. Don't know where the 'explicit deny' is coming from.</p>