The organization requires MFA for all IAM users and wants all API calls made via the CLI to be authenticated with MFA. An IAM policy denying calls without MFA was attached, but users still make CLI API calls without being prompted for tokens. What additional step is needed so CLI API calls require MFA?

The correct answer is to require users to obtain temporary credentials by calling Get-SessionToken and use those credentials to sign API requests. This is because AWS CLI commands, by default, do not directly prompt for MFA tokens. Instead, users must explicitly generate temporary credentials that are MFA-authenticated using the Get-SessionToken API call. These temporary credentials then include the MFA context, allowing subsequent CLI calls to be evaluated against IAM policies that enforce MFA. Enabling MFA on IAM roles and requiring users to assume them is a good security practice but doesn't directly solve the issue of CLI API calls requiring MFA for the initial user authentication. Having IAM users sign in to the AWS Management Console with MFA before running CLI commands does not transfer the MFA context to the CLI session. The statement that CLI does not support MFA is incorrect; it supports MFA through temporary credentials.