SOA-C02 Question 176
Single answerAn organization uses an AWS account to host its production workloads. The Security team recently implemented a requirement that all users accessing the AWS Management Console must authenticate using multi-factor authentication (MFA). As a SysOps Administrator, how can you enforce this requirement across all users in the account?
- A
Create an AWS Organizations Service Control Policy (SCP) that denies access to the AWS Management Console for users who do not use MFA.
- B
Attach an IAM policy to each user that includes a condition requiring MFA for all actions.
- C
Create an IAM group, attach an IAM policy that requires MFA for console access, and add all users to the group.
- D
Create an account-wide IAM policy with a condition that denies access to the AWS Management Console unless MFA is present.
Show answer and explanation
Correct answer: D
Explanation
To enforce MFA for all users accessing the AWS Management Console, an account-wide IAM policy should be created. This policy would include a condition statement that denies console access unless the user has successfully authenticated using MFA. This approach ensures the requirement is uniformly applied across all users in the account without needing to manage individual user permissions or group memberships.
- A. Incorrect.
AWS Organizations SCPs are used to define permissions across accounts, but they cannot enforce MFA requirements for specific actions such as accessing the AWS Management Console. SCPs apply only to accounts, not individual users.
- B. Incorrect.
IAM policies attached to individual users can enforce MFA for specific actions, but managing MFA requirements at the individual user level is not scalable or efficient, especially in larger organizations.
- C. Incorrect.
While IAM groups simplify permissions management, attaching a policy to a group that requires MFA will not automatically enforce the MFA requirement for all users unless the group is correctly used. This method is also less efficient than using account-wide policies.
- D. Correct.
An account-wide IAM policy with a condition that denies access to the AWS Management Console unless MFA is enabled is the correct and most efficient solution. The policy's condition can check for MFA authentication and enforce it for all users in the account.