Auditors require that privileged administrators who make sensitive IAM changes, whether from the console or the CLI, must have authenticated with a second factor. Which control enforces this across administrative roles?
Show answer and explanation
Answer: C
A deny statement on sensitive actions, using a BoolIfExists condition on aws:MultiFactorAuthPresent, blocks any session that was not authenticated with MFA. Administrators should enroll in phishing-resistant options such as FIDO2 security keys or hardware TOTP devices. This enforces the second factor for the sensitive actions regardless of how the administrator reached the API.
Why the other options are wrong
- A. Rotating access keys reduces the exposure of long-lived credentials. It does not require a second factor for any console or CLI session.
- B. Object Lock makes audit records immutable. It does not add an authentication step for administrators.
- D. Cognito user pool MFA secures end users of an application. It does not gate IAM users or role sessions that call AWS APIs.