Requiring MFA for sensitive actions

You want to let engineers stop production EC2 instances only if they signed in with MFA. Which condition does that?

"Condition": { "Bool": { "aws:MultiFactorAuthPresent": "true" } }