title: Enforce MFA for AWS console login but not for API calls
body: <p>I am looking to enforce all IAM users(local and remote) to enable and activate their MFA devices.
  I want them all to enable MFA to do their respective tasks.</p>
  <p>I am trying with the following policy</p>
  <pre class="lang-json prettyprint-override"><code>{
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Action&quot;: &quot;*&quot;,
        &quot;Resource&quot;: &quot;*&quot;,
        &quot;Condition&quot;: {&quot;Bool&quot;: {&quot;aws:MultiFactorAuthPresent&quot;: &quot;true&quot;}}
  }
  </code></pre>
  <p>However; this policy applies irrespective of how you are accessing the services, through console or through APIs.</p>
  <p>There is a lot of automation done by all users and their automation breaks as MFA authentication was not implied.</p>
  <p>As a first step, we wish everybody to at least enables MFA for console login; but the same should not enforce them to use MFA for API calls used in automation.</p>
  <p>Is this achievable through IAM policy?</p>
  <p>Thanks</p>