aws-vault: Unable to assume role with MFA

Hi. This looks like just the tool I’m after, but currently having some issues getting it working with a role that uses MFA. I’m not sure I see what I’m doing wrong.

I’ve just installed v4.6.0 on macOS 10.14.5. As you can see below, using the AWS CLI directly is fine, and I get prompted for the MFA token. But I don’t get prompted, and therefore seem to get AccessDenied, when using aws-vault.

From what I’ve read in the docs, it seems like this is totally supported in theory. Am I doing anything obviously wrong?

~/.aws/config

[profile root]
region=eu-west-1

[profile role-with-mfa]
source_profile = root
role_arn=arn:aws:iam::xxx:role/infrastructure
mfa_serial=arn:aws:iam::xxx:mfa/sam

sam:~/git/eff-infrastructure/accounts [master]$ aws-vault exec root -- aws sts get-caller-identity
{
    "UserId": "xyz",
    "Account": "xxx",
    "Arn": "arn:aws:iam::xxx:user/sam"
}

sam:~/git/eff-infrastructure/accounts [master]$ aws-vault exec role-with-mfa -- aws sts get-caller-identity
aws-vault: error: Failed to get credentials for root (source profile for role-with-mfa): AccessDenied: Access denied
	status code: 403, request id: cd493634-8d53-11e9-a8f2-395e97d62828

sam:~/git/eff-infrastructure/accounts [master]$ AWS_PROFILE=root aws sts get-caller-identity
{
    "UserId": "xyz",
    "Account": "xxx",
    "Arn": "arn:aws:iam::xxx:user/sam"
}

sam:~/git/eff-infrastructure/accounts [master]$ AWS_PROFILE=role-with-mfa aws sts get-caller-identity
Enter MFA code for arn:aws:iam::xxx:mfa/sam:
{
    "UserId": "xyz:botocore-session-1560372747",
    "Account": "xxx",
    "Arn": "arn:aws:sts::xxx:assumed-role/infrastructure/botocore-session-1560372747"
}