Question

A company wants to add an extra layer of protection to its IAM user sign-in process. Even if a user's password is stolen or guessed, the company wants to prevent unauthorized access by requiring a temporary code from a hardware device or authenticator app. Which AWS security feature meets this requirement?

Accepted Answer

Enable multi-factor authentication (MFA) for the IAM users

Answer

Attach an IAM policy that enforces a strong password rotation schedule

Answer

Store the user credentials in AWS Secrets Manager with automatic rotation

Answer

Configure a security group to restrict sign-in to trusted IP addresses