AWS IAM.在web中强制MFA，但不在CLI中强制

Question

希望缓慢迁移用户，并想知道是否可以只在web UI中启用MFA，而不在CLI中启用。

我有以下允许用户设置MFA

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAllUsersToListAccounts",
"Effect": "Allow",
"Action": [
"iam:ListUsers",
"iam:ListAccountAliases"
],
"Resource": "arn:aws:iam::*:user/*"
},
{
"Sid": "AllowIndividualUserToSeeTheirAccountInformation",
"Effect": "Allow",
"Action": [
"iam:GetLoginProfile",
"iam:GetAccountSummary",
"iam:GetAccountPasswordPolicy"
],
"Resource": "arn:aws:iam::470196620241:user/${aws:username}"
},
{
"Sid": "AllowIndividualUserToListTheirMFA",
"Effect": "Allow",
"Action": [
"iam:ListVirtualMFADevices",
"iam:ListMFADevices"
],
"Resource": [
"arn:aws:iam::470196620241:user/${aws:username}",
"arn:aws:iam::470196620241:mfa/*"
]
},
{
"Sid": "AllowIndividualUserToManageThierMFA",
"Effect": "Allow",
"Action": [
"iam:ResyncMFADevice",
"iam:EnableMFADevice",
"iam:DeleteVirtualMFADevice",
"iam:DeactivateMFADevice",
"iam:CreateVirtualMFADevice"
],
"Resource": [
"arn:aws:iam::470196620241:user/${aws:username}",
"arn:aws:iam::470196620241:mfa/${aws:username}"
]
},
{
"Sid": "DenyAllWithoutMFA",
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"BoolIfExists": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
]
}

这是可行的，但希望说用户可以

aws s3 ls 

在cli中，不使用MFA，但仅当MFA设置为时才起作用

Answer 1

AFAIK，不幸的是，这是不可能的，因为控制台和CLI都使用相同的权限集。