# Configuring MFA-protected API access

* **With IAM policies, you can specify which API operations a user is allowed to call**.\\

  * In some cases, you might want the additional security of **requiring users to be authenticated with AWS MFA before you allow them to perform particularly sensitive actions**.\\

    * **For example, you might want to restrict a destructive action like `TerminateInstances` and ensure that users can perform that action only if they authenticate with an AWS MFA device**.

* &#x20;This **policy grants users permission to call the Amazon EC2 `StopInstances` and `TerminateInstances` actions only if the user has authenticated using MFA**.

```
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "ec2:StopInstances",
      "ec2:TerminateInstances"
    ],
    "Resource": ["*"],
    "Condition": {"Bool": {"aws:MultiFactorAuthPresent": "true"}}
  }]
}
```

## `get-session-token`

* The `GetSessionToken` API operation **returns a set of temporary security credentials to an existing IAM user**.\\

* This is **useful for providing enhanced security, such as allowing AWS requests only when MFA is enabled for the IAM user**.
