Question

A financial services company uses AWS Organizations with all features enabled. The security team mandates that no IAM principal in any member account should be able to perform sensitive EC2 termination or RDS deletion actions unless the request is authenticated with multi-factor authentication (MFA). They want this enforced centrally so that even account administrators with broad IAM permissions cannot bypass it. Which approach meets this requirement with the least ongoing operational effort?

Accepted Answer

Attach a service control policy (SCP) to the organization root or relevant OUs that denies the sensitive actions when the condition key aws:MultiFactorAuthPresent is false.

Answer

Create an IAM permission boundary in each account that requires MFA and attach it to every IAM role and user in the organization.

Answer

Configure an IAM policy in each member account that grants the sensitive actions only when aws:MultiFactorAuthPresent is true, and attach it to all users.

Answer

Enable AWS Config rules in every account to detect principals lacking MFA and trigger automatic remediation that revokes their permissions.