aws-vault: Unable to assume role with MFA
Hi. This looks like just the tool I’m after, but currently having some issues getting it working with a role that uses MFA. I’m not sure I see what I’m doing wrong.
I’ve just installed v4.6.0 on macOS 10.14.5. As you can see below, using the AWS CLI directly is fine, and I get prompted for the MFA token. But I don’t get prompted, and therefore seem to get AccessDenied, when using aws-vault.
From what I’ve read in the docs, it seems like this is totally supported in theory. Am I doing anything obviously wrong?
~/.aws/config
[profile root]
region=eu-west-1
[profile role-with-mfa]
source_profile = root
role_arn=arn:aws:iam::xxx:role/infrastructure
mfa_serial=arn:aws:iam::xxx:mfa/sam
sam:~/git/eff-infrastructure/accounts [master]$ aws-vault exec root -- aws sts get-caller-identity
{
"UserId": "xyz",
"Account": "xxx",
"Arn": "arn:aws:iam::xxx:user/sam"
}
sam:~/git/eff-infrastructure/accounts [master]$ aws-vault exec role-with-mfa -- aws sts get-caller-identity
aws-vault: error: Failed to get credentials for root (source profile for role-with-mfa): AccessDenied: Access denied
status code: 403, request id: cd493634-8d53-11e9-a8f2-395e97d62828
sam:~/git/eff-infrastructure/accounts [master]$ AWS_PROFILE=root aws sts get-caller-identity
{
"UserId": "xyz",
"Account": "xxx",
"Arn": "arn:aws:iam::xxx:user/sam"
}
sam:~/git/eff-infrastructure/accounts [master]$ AWS_PROFILE=role-with-mfa aws sts get-caller-identity
Enter MFA code for arn:aws:iam::xxx:mfa/sam:
{
"UserId": "xyz:botocore-session-1560372747",
"Account": "xxx",
"Arn": "arn:aws:sts::xxx:assumed-role/infrastructure/botocore-session-1560372747"
}
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Comments: 25
If you want to downgrade to the earlier version (which works perfectly well for me) then you can do the following:
@FernandoMiguel you were right, actually my role had only ecs-tasks.amazonaws.com as trusted entities instead of the account number.
This a regression from https://github.com/99designs/aws-vault/pull/369
When the selected profile has mfa_serial and the root does not have mfa_serial, the session we create for the source_profile won’t use mfa, and we try to assume role using that session without mfa.
I can work on a fix for this today.
You can move your mfa_serial setting to your root profile, and things will work as expected for now.
@gawbul can you share the relevant entries from your aws config file with account numbers scrubbed?
If you recently upgraded, you might need to remove an old session:
aws-vault remove -s read-only
I’m able to reproduce this issue. I’m stepping through the code now to figure out the cause.