
Explanation:
BoolIfExists evaluates the condition only if the key exists. When aws:MultiFactorAuthPresent is false (no MFA), the Deny triggers. Sessions authenticated with MFA have this key set to true and are not denied.
Ultimate access to all questions.
No comments yet.
Question 6
A policy uses the aws:MultiFactorAuthPresent condition key as shown. When will access be denied?
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "s3:DeleteObject",
"Resource": "*",
"Condition": {
"BoolIfExists": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
]
}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "s3:DeleteObject",
"Resource": "*",
"Condition": {
"BoolIfExists": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
]
}
A
Always — s3:DeleteObject is always denied
B
When the request is made without MFA authentication
C
Only for IAM users; IAM roles are unaffected
D
When MFA is present in the session