This is a Bug Report

Description

• What went wrong?

  • Invoking sls deploy via SLS_DEBUG=* sls deploy --stage mystage --aws-profile my-cross-account-role-with-mfa, the application skips straight past the prompt for “Enter MFA code for…”
  • If an MFA token is entered at the next opportunity on stdin despite the output moving on, then the deploy will continue using the assumed role
  • If the user simply hits enter because it looks like the deploy has stalled, then the deploy will fail with an error about AWS provider credentials not found
  • This previously worked OK with 1.37.1, the application waited for an MFA token on stdin but on 1.50.0 the output continues and is quite misleading as the app is still waiting for input

• What did you expect should have happened?

  • Application should wait at the MFA prompt for user input, then continue using the cross-account role

• What was the config you used?

  • provider:
    name: aws
    runtime: python3.6
    stage: ${opt:stage, 'dev'}
    region: eu-west-1
    

  • ~/.aws/credentials

    [default]
    aws_access_key_id = <my-root-account-access-key-id>
    aws_secret_access_key = <my-root-account-access-key-id>
    

  • Root account user has MFA enabled
  • ~/.aws/config

    [profile my-cross-account-role-with-mfa]
    region = eu-west-1
    role_arn = arn:aws:iam::<target-account-id>:role/<role-name>
    source_profile = default
    

• What stacktrace or error message from your provider did you see?

  • Initial application output:

    $ export AWS_SDK_LOAD_CONFIG="true"
    $ SLS_DEBUG=* sls deploy --stage mystage --aws-profile my-cross-account-role-with-mfa
    Serverless: Load command config
    Serverless: Load command config:credentials
    [...]
    Serverless: Invoke deploy
    Serverless: Invoke package
    Serverless: Invoke aws:common:validate
    Enter MFA code for arn:aws:iam::<root-account-id>:mfa/<root-user-name>: Serverless:Invoke aws:common:cleanupTempDir
    Serverless: Generated requirements from /[...]/requirements.txt in /[...]/.serverless/requirements.txt...
    Serverless: Installing requirements from /[...]/.serverless/requirements/requirements.txt ...
    

  • Deploy continues

    AWS Pseudo Parameter: 
    Resources::ChannelDeleteLambdaPermissionS3::Properties::SourceArn Replaced 
    AWS::Region with ${AWS::Region}
    AWS Pseudo Parameter: 
    Resources::ChannelUpdateLambdaPermissionS3::Properties::SourceArn Replaced 
    AWS::Region with ${AWS::Region}
    <enter-MFA-token-here>
    Serverless: [AWS sts 200 0.65s 0 retries] assumeRole({ RoleArn: 
    [...]
    
    

Similar or dependent issues:

Additional Data

• Serverless Framework Version you’re using: 1.50.0
• Operating System: MacOS 10.13.6
• Stack Trace:
• Provider Error messages: