Enabling MFA for interactive login, disable for noninteractive

Hello.

If you only have one user pool, I think you need to set MFA to optional.
As you know, Cognito's MFA is tied to the user pool, so I don't think it can be configured for each app client.
https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa.html

I appear to be missing context. You stated:

My code use boto3 to validate provided user credentials

I assume your login code does not have each user's password. Typically computer access uses assume-role and tokens that do not directly access a user's credentials. Can you share a tad more about what you are trying to do?

In my case I use AWS Identity Center which asks for MfA and then does an assume-role in boto3. The assume role knows what user logged in. I am not using Cognito. So in your case you have a different requirement.

I assume your login code does not have each user's password.

You are right, there are no user passwords stored anywhere in app.

We need to provide REST API to users and arrange somehow, that they will see only the content relevant to them. So we have /login/ API endpoint, where user send own credentials, those are use together with client id/password and boto3.initiate_auth method to get tokens from cognito service, and those tokens are returned to user. Every other following request use received access_token in HTTP header. This is decoded in application, so we know who is accessing the resource and we can return data relevant to given person only.

Probably I confuse you by note about "...noninteractive process, where some machine tries to reach API..". I know, that some of the users will use it this way, so we need to find solution without any interactivity.

Thank you for you comment.