Hands-on emulator lab · 6–10 min
Require MFA in a practice policy — IAM and MFA policy conditions
Save an IAM policy that requires MFA context for a sensitive action.
These actions use an isolated AWS Emulator. It stores API state locally; it does not create paid cloud resources or run the full hosted AWS service.
Your goal
Save an IAM policy that requires MFA context for a sensitive action.
Why this matters
A sensitive action can require MFA context in an IAM policy. You will save and read such a condition for a practice user. The exercise does not enroll an authenticator or secure a real login.
Words you will use
MFA means multi-factor authentication. It adds proof beyond a password. Phishing tries to trick someone into giving away access. A recovery method helps regain legitimate access.
How to proceed
Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.
1. Create a practice identity
Create an IAM user record without a password or access keys. You will configure a policy for this identity. This does not create a login for CloudArcade.
2. Add an MFA condition
Save an explicit deny for deleting practice objects when MFA context is false or missing. Inspect BoolIfExists in the request. MFA context has important limits with different credential types.
3. Read the stored condition
Retrieve the policy and find aws:MultiFactorAuthPresent. This lab verifies policy configuration. It does not enroll an authenticator, issue a one-time code, or test a real login.
Practice, then check your understanding
Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.
Read the official AWS documentation for service behavior and production details.