Which STS API Supports MFA for Cross-Account S3 Access?
A developer must use multi-factor authentication (MFA) to access data in an Amazon S3 bucket that is in another AWS account. Which AWS Security Token Service (AWS STS) API operation should the developer use with the MFA information to meet this requirement?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests that AssumeRole is the only STS action among the options that lets you pass MFA device information for a cross-account session; the 'WithWebIdentity' and 'WithSAML' variants target different federation methods.
In AWS DVA-C02, the correct STS operation for cross-account S3 access that requires MFA is AssumeRole, because it accepts MFA context and role trust policies can enforce MFA. Community votes, comments, and AWS documentation confirm the answer is D.
Selecting AssumeRoleWithSAML or GetFederationToken because they seem related to identity federation; however, MFA for cross-account access is specifically done through AssumeRole with SerialNumber and TokenCode.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The AssumeRole API is the correct choice because it accepts multi-factor authentication details through the SerialNumber and TokenCode parameters. In a cross-account scenario, the target account's role trust policy can include a condition such as aws:MultiFactorAuthPresent: true to enforce MFA. This is exactly what the scenario requires, and it is a known pattern for protecting cross-account resource access. As comment [1] points out, “You can include multi-factor authentication (MFA) information when you call AssumeRole... the trust policy of the role being assumed includes a condition that tests for MFA authentication.”
Why the Other Options Are Wrong
AssumeRoleWithWebIdentity is meant for users who authenticate with a web identity provider, not for AWS users adding MFA to an existing cross-account role assumption. GetFederationToken issues temporary credentials for a federated user but is not designed for cross-account role access with MFA enforcement. AssumeRoleWithSAML requires SAML-based authentication and is not the API used to pass MFA device information directly. None of these options allow the same MFA-aware cross-account pattern as AssumeRole.
Community Comment Notes
The community answers are unanimous: all votes and comments support D. Comment [2] links to the official IAM documentation about configuring MFA for API operations, reinforcing that AssumeRole is the API used for MFA-protected cross-account access. Comment [5] simply states MFA with AssumeRole always, and comment [3] confirms D is the correct answer.
Official Reference
Exam Strategy
When you see cross-account access plus MFA, immediately think AssumeRole. Practice distinguishing AssumeRole from AssumeRoleWithWebIdentity and AssumeRoleWithSAML by their use cases: web identity for social/external IdPs, SAML for enterprise IdPs, and plain AssumeRole for AWS-identity MFA and cross-account roles.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →