A developer must use multi-factor authentication (MFA) to access data in an Amazon S3 bucket that is in another AWS account. Which AWS Security Token Service (AWS STS) API operation should the developer use with the MFA information to meet this requirement?

The AssumeRole API operation is the standard method for an IAM entity (like a user or role) to obtain temporary security credentials for an IAM role in the same or a different AWS account. This operation is specifically designed for cross-account access scenarios. To enforce multi-factor authentication (MFA), the AssumeRole call must include the SerialNumber parameter (the ARN of the user's MFA device) and the TokenCode parameter (the temporary one-time password from the device). The trust policy of the target role must be configured to allow the sts:AssumeRole action from the developer's account, and it can include a condition that requires MFA to be present for the call to succeed.

A. AssumeRoleWithWebidentity: This operation is used to obtain credentials for users authenticated by a web identity provider (e.g., Amazon Cognito, Google, Facebook), not for an existing IAM user.
B. GetFederationToken: This operation provides temporary credentials for a federated user, typically in custom identity broker scenarios. It does not assume a role, which is required for cross-account access.
C. AssumeRoleWithSAML: This is used for users authenticated through a SAML 2.0 identity provider (e.g., ADFS). It is not intended for a standard IAM user making a direct API call. ---

1. AWS Security Token Service API Reference - AssumeRole: "Returns a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to. These temporary credentials consist of an access key ID

a secret access key

and a security token. [...] You must also provide a value for the SerialNumber parameter and for the TokenCode parameter if the trust policy of the role requires multi-factor authentication (MFA)."

Source: AWS Documentation

AWS Security Token Service API Reference

"Actions - AssumeRole"

Request Parameters section.

2. AWS Identity and Access Management User Guide - Configuring MFA-protected API access: "You can require that users be authenticated with an MFA device to access trusted APIs. [...] To do this

you create a policy with a condition that checks whether the user was authenticated using an MFA device. [...] When a user with this policy makes a call to sts:AssumeRole

the request fails if the user did not authenticate with MFA."

Source: AWS Documentation

IAM User Guide

"Security best practices in IAM - Require multi-factor authentication (MFA) - Configuring MFA-protected API access".

3. AWS Identity and Access Management User Guide - Comparing the AWS STS API operations: This document provides a table comparing AssumeRole

AssumeRoleWithSAML

AssumeRoleWithWebIdentity

and GetFederationToken

clearly delineating their distinct use cases. It shows AssumeRole is for "IAM user or role" principals

while the others are for specific federation scenarios.

Source: AWS Documentation

IAM User Guide

"Temporary security credentials - Common scenarios for temporary credentials - Comparing the AWS STS API operations".