A company has two AWS accounts: Account A and Account B. Account A provides an IAM role that users in Account B assume to upload sensitive documents to S3 buckets in Account A. A new requirement states users may assume the role only when authenticated with multi-factor authentication (MFA). What is the lowest-risk, lowest-effort way to meet this requirement?

The correct answer is to add an aws:MultiFactorAuthPresent condition to the role’s trust policy. The trust policy defines who can assume the role. By adding this condition, you ensure that only principals who have authenticated with MFA can assume the role, directly addressing the requirement for MFA during role assumption. Adding the condition to the role's permissions policy would not work because the permissions policy defines what actions the assumed role can perform, not who can assume it. Adding it to a session policy is incorrect because session policies are applied after the role is assumed, not during the assumption process itself. Applying it to S3 bucket policies would only restrict access to the S3 buckets, not the act of assuming the role, and would require modifying every relevant bucket policy.