A security team wants an IAM policy statement that allows a sensitive action only when the calling principal authenticated with multi-factor authentication during the current session. Which policy element accomplishes this?
- A resource-based policy on the target service that checks the caller's password history
- A permissions boundary set to a built-in "MFA-only" mode
- A Condition element that tests the aws:MultiFactorAuthPresent context key against true
- A separate IAM group named "MFA-users" that AWS automatically enforces at the API layer
Why C? And why not the others?
Correct answer: C. A Condition element that tests the aws:MultiFactorAuthPresent context key against true
IAM policies can include a Condition element that evaluates request context keys at the moment an API call is made, and aws:MultiFactorAuthPresent is the specific global condition key that is true only when the calling principal's current session was authenticated with MFA, so a policy statement conditioned on it will only take effect for MFA-authenticated sessions. The option describing a resource-based policy that checks password history is wrong because IAM policies, resource-based or otherwise, do not have access to or evaluate a principal's password history; MFA presence is a session-level fact, not a password attribute. The option describing a permissions boundary with a built-in MFA-only mode is wrong because permissions boundaries are ordinary managed policies that cap maximum permissions; there is no special MFA-enforcement mode built into the boundary feature itself, MFA must still be enforced through a Condition element. The option describing an IAM group that AWS automatically enforces is wrong because group membership is just a way to attach policies to multiple users; AWS does not automatically interpret a group's name as a security requirement, and the enforcement must still come from an explicit Condition element on a policy.
Source: AWS IAM documentation: IAM global condition context keys — aws:MultiFactorAuthPresent