How to enforce MFA for AWS CLI EC2 commands?

SCS-C03 By islever Editorial Last updated

Design, implement, and troubleshoot authentication for AWS resources. Design, implement, and troubleshoot authorization for AWS resources.

Short answer

B Run aws sts get-session-token with --serial-number and --token-code, then use the MFA-authenticated temporary credentials for CLI calls.

Question

An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication:
Exhibit: How to enforce MFA for AWS CLI EC2 commands?
After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI.
What should the administrator do to resolve this problem while still enforcing multi-factor authentication?
  1. Change the value of aws:MultiFactorAuthPresent to true.
  2. Instruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls. Correct Answer
  3. Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
  4. Create a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.

Key Takeaways

This item tests how aws:MultiFactorAuthPresent is populated for CLI sessions and the trap of treating it as an editable policy value rather than an AWS-generated request context key.

The IAM policy blocks EC2 CLI actions when aws:MultiFactorAuthPresent is false, so long-term access keys cannot satisfy it. The page establishes that users must obtain MFA-authenticated temporary STS credentials with aws sts get-session-token before making CLI calls.

Common mistake: Most candidates pick A and try to set aws:MultiFactorAuthPresent to true, but that condition key is supplied by AWS after MFA authentication and cannot be forced by editing the policy.

Expert Analysis

Why the Answer Is Correct

The policy denies EC2 commands when aws:MultiFactorAuthPresent is false or absent. Long-term AWS CLI access keys are not MFA-authenticated, so every EC2 call made directly with those keys still carries a false or absent MFA context. Running aws sts get-session-token with the user's MFA serial number and current token code returns temporary credentials that include MFA context. Any later CLI call using those temporary credentials satisfies the condition, so permitted EC2 actions proceed while the original deny remains in place.

Why the Other Options Are Wrong

A is invalid because aws:MultiFactorAuthPresent is a request context key populated by AWS after MFA authentication, not a value an administrator can set to true in a policy. C could enforce MFA through a SAML identity provider, but it requires federated API/CLI access and does not directly fix the existing IAM-user CLI workflow described here. D is unnecessarily complex and risky: adding sts:AssumeRole to NotAction weakens the original deny statement and shifts enforcement to a new role trust policy instead of directly obtaining MFA-authenticated session credentials for CLI calls.

Community Comment Notes

All visible commenters settle on B, and bigdata2ml points directly to the AWS STS GetSessionToken API reference. giancesarini2023 explains that the command "generates temporary MFA-authenticated credentials", which is exactly the behavior needed for the aws:MultiFactorAuthPresent condition. gonzales captures the operational rule: "MFA for CLI = temporary credentials (STS), not long-term access keys." Liongeek also paraphrases the required aws sts get-session-token invocation with --serial-number and --token-code.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a CLI/API user is blocked by an MFA condition key, look for the STS operation that returns MFA-authenticated temporary credentials instead of modifying the condition. In SCS-C03, distinguish long-term IAM user keys from session credentials and check whether the deny policy already allows sts:GetSessionToken.

Frequently Asked Questions

Why do long-term AWS CLI access keys fail when the IAM policy requires MFA?

Long-term access keys are not MFA-authenticated, so aws:MultiFactorAuthPresent stays false and the deny applies. STS GetSessionToken returns temporary MFA-backed credentials.

Can adding sts:AssumeRole to NotAction in the MFA deny policy solve CLI access?

It can shift enforcement to a role trust policy, but it changes the architecture and can weaken the original deny. Option B's GetSessionToken flow directly supplies MFA-authenticated CLI credentials.

More SCS-C03 FAQ →

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. bigdata2ml 👍 2 Answered B
    https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html
  2. 7f6aef3 👍 1 Answered B
    aws sts get-session-token con los parámetros --serial-number (ARN del dispositivo MFA) y --token-code (código del dispositivo) genera credenciales temporales de sesión que incluyen el contexto de MFA. Al usar esas credenciales temporales para las llamadas al CLI/API, la clave aws:MultiFactorAuthPresent será true, y el Deny ya no se aplica. Esto resuelve el problema manteniendo el requisito de MFA.
  3. giancesarini2023 👍 1 Answered B
    B because the sts get-session-token command generates temporary MFA-authenticated credentials, allowing AWS CLI requests to satisfy the aws:MultiFactorAuthPresent condition.
  4. Liongeek 👍 1 Answered B
    The right answer is B aws sts get-session-token \ --serial-number arn:aws:iam::123456789012:mfa/username \ --token-code 123456
  5. gonzales 👍 1 Answered B
    MFA for CLI = temporary credentials (STS), not long-term access keys

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How should a secured S3 CloudFormation template be shared across AWS Organizations?

S-grade

How Do You Disable a Compromised IAM Identity Center User and Audit Activity?

S-grade

How to Find S3 Buckets with Sensitive Data Using Macie with Least Overhead?

S-grade

How Can the Security Team Trace a Former Employee's Access Key Activity in AWS?

S-grade

Practice All SCS-C03 Questions

Access 86 questions with complete answers and detailed explanations.

View Full SCS-C03 Practice Test →

← Back to SCS-C03 Study Guide