
Explanation:
BoolIfExists evaluates the condition only if the key exists. When aws:MultiFactorAuthPresent is false (no MFA), the Deny triggers. Sessions authenticated with MFA have this key set to true and are not denied.
Ultimate access to all questions.
A policy uses the aws:MultiFactorAuthPresent condition key as shown. When will access be denied?
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "s3:DeleteObject",
"Resource": "*",
"Condition": {
"BoolIfExists": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
]
}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "s3:DeleteObject",
"Resource": "*",
"Condition": {
"BoolIfExists": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
]
}
A
Always — s3:DeleteObject is always denied
B
When the request is made without MFA authentication
C
Only for IAM users; IAM roles are unaffected
D
When MFA is present in the session
No comments yet.