Let CLI users satisfy an MFA-required policy with aws sts get-session-token and MFA parameters

SCS-C02 By islever Editorial Last updated

Design, implement, and troubleshoot authentication for AWS resources. Design, implement, and troubleshoot authorization for AWS resources.

Short answer

B Users run aws sts get-session-token with MFA serial and token code, then use the temporary credentials for CLI calls.

Question

An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication: After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication? - Exhibit: Let CLI users satisfy an MFA-required policy with aws sts
  1. Change the value of aws:MultiFactorAuthPresent to true.
  2. Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls. Correct Answer
  3. Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
  4. Create a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.

Key Takeaways

Long-term IAM user keys do not satisfy an MFA-required policy. sts get-session-token with MFA parameters returns short-term credentials whose requests are evaluated as MFA-present, so they pass the policy condition. The temporary access key, secret, and session token are used for the actual CLI calls.

An IAM group policy denies actions unless the request includes MFA (aws:MultiFactorAuthPresent), so users cannot run EC2 CLI commands with their long-term keys. The fix is for users to call aws sts get-session-token passing --serial-number and --token-code, producing temporary credentials that carry the MFA condition, then use those temporary credentials for subsequent CLI/API calls. This keeps MFA enforcement while restoring CLI access.

Common mistake: Setting aws:MultiFactorAuthPresent to true in the policy (option A)—that would weaken/break the enforcement, not help users authenticate. Or assuming federated SAML (C) or assume-role (D) is required; get-session-token is the direct CLI solution for an MFA-conditioned user policy.

Expert Analysis

Why the Answer Is Correct

The policy denies calls unless MFA is present, which long-term keys cannot satisfy. aws sts get-session-token with the MFA serial number and token code returns temporary credentials that are treated as MFA-authenticated; using those credentials for subsequent CLI calls satisfies the condition and restores EC2 command access without relaxing the policy.

Why the Other Options Are Wrong

A changes the policy value to true, which would defeat MFA enforcement rather than help users authenticate. C (SAML federation) and D (assume-role) are alternative architectures but unnecessary; get-session-token is the straightforward way for existing IAM users to obtain MFA-validated temporary credentials for the CLI. B is the correct, minimal fix.

Community Comment Notes

Community voted B (100). Commenters explained that get-session-token with MFA parameters yields temporary credentials recognized as MFA-present, satisfying the policy for CLI calls. The policy JSON is shown in the question image; the stated requirement (MFA enforcement) makes B the canonical solution.

Official Reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html

This link opens the official vendor documentation in a new tab.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. sarcactus 👍 3 Answered B
    I agree with MikeRach comment.
  2. molerowan 👍 1 Answered B
    aws sts get-session-token with MFA parameters creates temporary credentials that include MFA verification These temporary credentials (access key, secret key, and session token) can be used for subsequent CLI calls The AWS CLI will then recognize these requests as being made with MFA authentication, satisfying the policy condition
  3. MikeRach 👍 1
    B a public discussion thread on this question
  4. awssecuritynewbie 👍 1 Answered B
    B for sure they required to enable CLI
  5. nublit 👍 1 Answered B
    B for sure

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide