Python + shell script to streamline official AWS process for using MFA with the AWS CLI
Matches to: https://aws.amazon.com/premiumsupport/knowledge-center/authenticate-mfa-cli/
Note that you MUST source
(or its synonym .
) to change env vars in your current shell:
. aws-cli-mfa $AWS_MFA_ARN 123456
. aws-cli-mfa $AWS_MFA_ARN 123456 -p rogusdev -d 57600
Meaning, the period at the beginning of those lines above is a critical, vital part of using this application.
You must have jq
, python 3 (as python3
), and the aws cli (as aws
) available on your PATH in your shell.
You will pass, at a minimum, your AWS MFA ARN and the current MFA auth token from your 2fa/mfa authenticator app/device. This does not work with yubikeys/etc (per AWS docs). There are additional optional args to change the effects this script has on your system.
I recommend you have your AWS_MFA_ARN in your .bash_profile
or as appropriate for your shell:
echo 'export AWS_MFA_ARN=arn:aws:iam::NUMBER:mfa/USERNAME' >> $HOME/.bash_profile
Replacing the number and username as appropriate. Your MFA ARN is on this page:
https://console.aws.amazon.com/iam/home?#/security_credentials
To see all the options, run the script with -h
:
aws-cli-mfa -h
Use the correct shell for where you are going to use this:
AWS_CLI_MFA_SHELL=bash &&
wget https://raw.githubusercontent.com/rogusdev/aws-cli-mfa/main/bin/aws-cli-mfa-$AWS_CLI_MFA_SHELL -O aws-cli-mfa &&
sudo mv aws-cli-mfa /usr/local/bin/ && sudo chmod +x /usr/local/bin/aws-cli-mfa
You might also need to install dependencies as well:
Installing jq
and wget
(in case you don't have wget to download this script as above):
brew install jq wget # osx
sudo apt-get install jq wget # debian/ubuntu
# etc
Installing aws
: https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html
Installing python3
can be done in a variety of ways, however I recommend using asdf
: https://github.com/danhper/asdf-python
Clone the repo and create all shells' final aws-cli-mfa-*
scripts and then copy your preference like so:
AWS_CLI_MFA_SHELL=bash &&
./build.sh && sudo cp ./bin/aws-cli-mfa-$AWS_CLI_MFA_SHELL /usr/local/bin/aws-cli-mfa
Current shell options are: bash
, zsh
, ksh
(For the curious, the -e "s///"
gets rid of the #INSERT_PYTHON_CODE_HERE
.)
Tests for the core python functionality to call the aws cli with the right args and parse the results:
python3 -m unittest tests.aws_cli_mfa_tests
Tests for the shell scripts that wrap around the python script to set env vars when sourced:
./tests/tests.sh