mfa-aws

Helper script for using MFA with the aws cli. Requires python3.

Usage

usage: mfa-aws [options]

updates aws credentials file with temporary sts credentials obtained with mfa

optional arguments:
  -h, --help            show this help message and exit
  -d, --debug           Enable debug
  -c CONFIG_FILE, --config-file CONFIG_FILE
                        config file to load mfa details [~/.aws/mfa-config]
  -p PROFILE, --profile PROFILE
                        profile to be loaded from the config file [default]

Example

Before

[~/.aws/credentials]

[default]
aws_access_key_id = ASIADSJFKDSF3242
aws_secret_access_key = FDSFSDKJFd/fdsfSDFSFfDSF4837fdDSFHDKSFsd0D

[other-account-default]
aws_access_key_id = ASIADSGFDDFG3897
aws_secret_access_key = DFGKSJGSDKJGSDKJ4636//43643KJ353KJH/KFDFSDFS/DLKDKSFsd0D

[~/.aws/mfa-config]

[profile default]
mfa_serial = arn:aws:iam::111111111111:mfa/username
dest_profile = default-mfa

[profile other-account]
mfa_serial = arn:aws:iam::999999999999:mfa/username
dest_profile = other-account-mfa
source_profile = other-account-default

Run

MBP-USERNAME:~ username$ mfa-aws
token code for arn:aws:iam::111111111111:mfa/username: 111111
MBP-USERNAME:~ username$
MBP-USERNAME:~ username$ mfa-aws -p other-account
token code for arn:aws:iam::999999999999:mfa/username: 999999
MBP-USERNAME:~ username$

After

[~/.aws/credentials]

[default]
aws_access_key_id = ASIADSJFKDSF3242
aws_secret_access_key = FDSFSDKJFd/fdsfSDFSFfDSF4837fdDSFHDKSFsd0D

[other-account-default]
aws_access_key_id = ASIADSGFDDFG3897
aws_secret_access_key = DFGKSJGSDKJGSDKJ4636//43643KJ353KJH/KFDFSDFS/DLKDKSFsd0D

[default-mfa]
aws_access_key_id = ASIADSJFKDSF3242
aws_secret_access_key = FDSFSDKJFd/fdsfSDFSFfDSF4837fdDSFHDKSFsd0D
aws_session_token = RIKJSFSAFJAS128753718965/352523//35jfhdssdDSJFKRIKJSFSAFJAS128753718965/352523//35jfhdssdDSJFKRIKJSFSAFJAS128753718965/352523//35jfhdssdDSJFK

[other-account-mfa]
aws_access_key_id = ASIADSGFDDFG3897
aws_secret_access_key = DFGKSJGSDKJGSDKJ4636//43643KJ353KJH/KFDFSDFS/DLKDKSFsd0D
aws_session_token = DFKJSF8732ASFAJKFHFHK324423/rekjAF/33kjfDFJKKJFDDFKJSF8732ASFAJKFHFHK324423/rekjAF/33kjfDFJKKJFDDFKJSF8732ASFAJKFHFHK324423/rekjAF/33kjfDFJKKJFD

Integrations

YubiKey

The TOTP functionality of YubiKey tokens can be integrated on the cli through the ykman cli utility. Just specify the yubikey_credential_name in the mfa-config profile.

[profile yubikey-account]
mfa_serial = arn:aws:iam::999999999999:mfa/jamie
yubikey_credential_name = AWS:jamie@yubikey-account
dest_profile = yubikey-account-mfa
source_profile = yubikey-account-default

yubikey_credential_name is of the form Issuer:AccountName and can be viewed with the following ykman command.

ykman oath list

Metadata

Release files for mfa-aws 1.0.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for mfa-aws 1.0.1
File	Size	Uploaded
mfa-aws-1.0.1.tar.gz	9.2 kB	Jun 29, 2022	Details

Built distribution (wheel)

Table of built distributions (wheels) for mfa-aws 1.0.1
File	Interpreter	ABI	Platform	Reset
mfa_aws-1.0.1-py3-none-any.whl 9.5 kB Jun 29, 2022	Python 3	none	any	Details

Total release size: 18.7 kB

Release files / mfa-aws-1.0.1.tar.gz

Download URL	mfa-aws-1.0.1.tar.gz
Size	9.2 kB
Tags	Source
SHA-256 checksum How to use checksums	`b85eb7644e30dca2f8b583e18084f821db65a202c2275974a25649bbbbae991d`
BLAKE2b-256 checksum How to use checksums	`e07bfecee251bf66e620361548e94809b6252b304136cba2f5d59f92caa5cff2`
Upload date	Jun 29, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.1 CPython/3.10.5`

Release files / mfa_aws-1.0.1-py3-none-any.whl

Download URL	mfa_aws-1.0.1-py3-none-any.whl
Size	9.5 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`2073a60645430260449c5f55c8b7b4ed75c5504e4e2655c23cdff2c94fbf241e`
BLAKE2b-256 checksum How to use checksums	`6620bf6382d111b3ef438bbb038b6c62bf82abbafff104385028660c7b273f0d`
Upload date	Jun 29, 2022
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.1 CPython/3.10.5`