{"id":"cloudtrail-federated-user-mfa-always-false","text":"Federated user sign-in events always show `mfaAuthenticated: \"false\"` and `MFAUsed: \"No\"` because MFA is evaluated at the federation/STS level, not at console sign-in.","truth_value":"IN","source":"entries/2026/03/12/awscloudtrail-latest-userguide-cloudtrail-event-reference-aws-console-sign-in-ev.md","source_url":"","source_hash":"e0db43e03ee3996f","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"cloudtrail-federated-user-mfa-always-false","truth_value":"IN","reason":"premise"}]}}