Why is a Deny on aws:MultiFactorAuthPresent written with BoolIfExists rather than Bool?

Question

Accepted Answer

Some requests omit the key — with plain Bool those calls escape the deny entirely — Requests made with long-term access keys never carry the MFA key at all, so a Deny keyed on Bool false does not match them and the protection quietly fails open; BoolIfExists makes the absent case match. The key is never duplicated, SAML assertions are surfaced as ordinary context keys, and conditions are evaluated per request rather than re-checked over time.

Answer

Some requests set it twice — BoolIfExists takes the last value rather than failing

Answer

Some requests use SAML — BoolIfExists reads the assertion instead of the context

Answer

Some requests are long-lived — BoolIfExists re-evaluates the key as the session ages

Why is a Deny on aws:MultiFactorAuthPresent written with BoolIfExists rather than Bool?

Why this is the answer

More AWS IAM: Identity and Access Management Policies flashcards