Requiring multi-factor authentication for sensitive AWS actions is one of the highest-value, lowest-cost security controls an account can adopt, and it is expressed in IAM entirely through a single condition key: aws:MultiFactorAuthPresent. MFA-Required Policy Condition Generator builds the statement that enforces it, including the optional, less commonly known second layer — requiring that the MFA authentication itself was recent, not just present at some point in the session.
The core of every statement this tool produces is the same: a Bool condition checking aws:MultiFactorAuthPresent equals "true". AWS sets this key only when the calling principal's session was actually authenticated with MFA; if MFA was never used, the key is absent from the request context entirely, and the condition evaluates to false. You choose the Effect the statement should carry — Allow, if you are narrowly granting a specific sensitive action only when MFA is present, or Deny, for the far more common pattern of attaching a broad statement that blocks an action whenever MFA is not present, letting some other Allow statement's permission only take effect once MFA has been used. The condition logic itself does not change between the two; only what the Effect means in context does, and the tool lets you pick either.
The optional second layer addresses a real gap in "MFA present" alone: a session can authenticate with MFA once, at login, and then remain valid — and MFA-present — for hours or days afterward, depending on session duration settings. For genuinely sensitive actions, some organizations want more than "MFA happened at some point"; they want "MFA happened recently." AWS exposes exactly this via aws:MultiFactorAuthAge, the number of seconds elapsed since the MFA authentication occurred, paired with the NumericLessThanEquals operator and a threshold you choose. Enabling the checkbox adds this as a second, independent entry in the same Condition block (both entries must hold for the statement to apply), with a sensible one-hour default of 3600 seconds that you can adjust to whatever your security posture requires. Because this genuinely changes behavior — a long-lived session that used MFA once will eventually stop satisfying a recent-MFA check — it is left as an explicit, visible opt-in rather than silently bundled in.
Beyond the condition itself, the tool is a standard statement builder: pick an Effect, list the actions the condition should govern (one per line — a blanket * for "every action," or a specific set like iam:DeleteUser), list the resources it applies to, and give the statement an optional Sid. The assembled statement runs through the same structural validator used across this tool category before being shown, confirming Version, Effect, Action, and Resource are all present and well-formed.
What this tool does not do is configure MFA itself — assigning an MFA device to a user, or requiring one be set up before any other action is permitted, are separate IAM/account configuration steps outside a policy condition. It also does not call AWS to verify anything; the entire assembly and validation happens locally in your browser.