How do I enforce MFA authentication for IAM users that use the AWS Management Console and the AWS CLI?

Short description

The following example IAM policy requires IAM users to use MFA to access specific AWS services:

{  "Sid": "BlockMostAccessUnlessSignedInWithMFA",
  "Effect": "Deny",
  "NotAction": [
    "iam:CreateVirtualMFADevice",
    "iam:DeleteVirtualMFADevice",
    "iam:ListVirtualMFADevices",
    "iam:EnableMFADevice",
    "iam:ResyncMFADevice",
    "iam:ListAccountAliases",
    "iam:ListUsers",
    "iam:ListSSHPublicKeys",
    "iam:ListAccessKeys",
    "iam:ListServiceSpecificCredentials",
    "iam:ListMFADevices",
    "iam:GetAccountSummary",
    "sts:GetSessionToken"
  ],
  "Resource": "*",
  "Condition": {
    "Bool": {
      "aws:MultiFactorAuthPresent": "false",
      "aws:ViaAWSService": "false"
    }
  }
}

In the preceding policy, IAM users that use the AWS Management Console are prompted to enter MFA authentication credentials to access AWS services. However, IAM users that use the AWS CLI aren't prompted to enter MFA authentication credentials to access AWS services.

Resolution

Note: If you receive errors when you run AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Because the aws:MultiFactorAuthPresent key doesn't exist in long-term credentials requests, the key doesn't deny access to the requests. If the key in the policy isn't with the Boolean condition operator, then the values don't match.

IAM users that use the AWS Management Console generate temporary credentials and allow access only when they use MFA.

To enforce MFA authentication with the AWS CLI, add the IfExists condition operator to check if the MultiFactorAuthPresent key is in the request. The Boolean condition lets you restrict access with a key value that's set to true or false. If the MultiFactorAuthPresent key isn't in the request, then IfExists evaluates the condition element as true.

Example IAM policy:

{
    "Sid": "BlockMostAccessUnlessSignedInWithMFA",
    "Effect": "Deny",
    "NotAction": [
        "iam:CreateVirtualMFADevice",
        "iam:DeleteVirtualMFADevice",
        "iam:ListVirtualMFADevices",
        "iam:EnableMFADevice",
        "iam:ResyncMFADevice",
        "iam:ListAccountAliases",
        "iam:ListUsers",
        "iam:ListSSHPublicKeys",
        "iam:ListAccessKeys",
        "iam:ListServiceSpecificCredentials",
        "iam:ListMFADevices",
        "iam:GetAccountSummary",
        "sts:GetSessionToken"
    ],
    "Resource": "*",
    "Condition": {
        "BoolIfExists": {
            "aws:MultiFactorAuthPresent": "false",
            "aws:ViaAWSService": "false"
        }
    }
}

Note: IAM users that use the AWS CLI with long-term credentials are denied access and must use MFA to authenticate. Make sure to use an MFA token to authenticate your CLI session.

Related information

How do I require users from other AWS accounts to use MFA to access my Amazon S3 buckets?

Using multi-factor authentication

Assign MFA devices in the AWS CLI or AWS API