AWS - Identity and Access Management
You want to enforce MFA for all IAM users in your AWS account to improve security. Which approach is the best practice to achieve this?
You want to enforce MFA for all IAM users in your AWS account to improve security. Which approach is the best practice to achieve this?
hard📝 Best Practice Q15 of 15
Step-by-Step Solution
Solution:
Step 1: Understand MFA enforcement methods
To enforce MFA, you need a policy that denies actions unless MFA is present. This ensures users cannot bypass MFA even if enabled.Step 2: Evaluate options for best practice
Create an IAM policy that denies all actions unless MFA is used, then attach it to all users uses an IAM policy to enforce MFA for all users, which is scalable and secure. Other options either lack enforcement or reduce security.Final Answer:
Create an IAM policy that denies all actions unless MFA is used, then attach it to all users -> Option BQuick Check:
Enforce MFA with deny policy = Create an IAM policy that denies all actions unless MFA is used, then attach it to all users [OK]
Quick Trick: Use deny policy requiring MFA for all users [OK]
Common Mistakes:
- Relying on manual enabling without enforcement
- Using password rotation instead of MFA
- Sharing one MFA device among users
Master "Identity and Access Management" in AWS
Want More Practice?
15+ quiz questions · All difficulty levels · Free
Free Signup - Practice All QuestionsMore AWS Quizzes