An AWS account administrator attached a managed policy to an IAM group to require that each user authenticate with multi-factor authentication (MFA). After enabling the policy, users report that they cannot run Amazon EC2 commands with the AWS CLI. How should the administrator resolve this while still enforcing MFA?

When an IAM policy requires MFA, users cannot directly use their long-term credentials (like access keys) for CLI/API calls. The aws sts get-session-token command is designed for this scenario. Users provide their MFA device serial number and the current token code to obtain temporary credentials that are authenticated with MFA. These temporary credentials can then be used for subsequent CLI/API operations, satisfying the MFA requirement. Setting aws:MultiFactorAuthPresent to true in the policy is the condition that enforces MFA, but it doesn't tell users how to satisfy it for CLI/API. Implementing federated access is a valid solution for broader identity management but is an architectural change, not a quick fix for existing users. Using sts assume-role with MFA is for assuming a role, not for authenticating the initial user session with MFA when using their own credentials.