Question
A security engineer is designing an IAM policy to protect AWS API operations. The policy must enforce multi-factor authentication (MFA) for IAM users to access certain services in the AWS production account. Each session must remain valid for only 2 hours. The current version of the IAM policy is as follows:
```json
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:StopInstances",
"ec2:TerminateInstances"
],
"Resource": ["*"]
}]
}
```
Which combination of conditions must the security engineer add to the IAM policy to meet these requirements? (Choose two.)
- A. "Bool": {"aws:MultiFactorAuthPresent": "true"} Correct
- B. "Bool": {"aws:MultiFactorAuthPresent": "false"}
- C. "NumericLessThan": {"aws:MultiFactorAuthAge": "7200"} Correct
- D. "NumericGreaterThan": {"aws:MultiFactorAuthAge": "7200"}
- E. "NumericLessThan": {"MaxSessionDuration": "7200"}
Explanation
Option A ensures that multi-factor authentication (MFA) is present for IAM users accessing the specified services. Option C enforces that the session duration since MFA was last used must be less than 7200 seconds (2 hours), aligning with the requirement to limit session validity.
