Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support mfa without assume role. #1985

Open
glennpratt opened this issue May 20, 2016 · 23 comments
Open

Support mfa without assume role. #1985

glennpratt opened this issue May 20, 2016 · 23 comments
Labels
community contribution-ready feature-request A feature should be added or improved. needs-review This issue or pull request needs review from a core team member. p2 This is a standard priority issue

Comments

@glennpratt
Copy link

Given the following profile:

[profile test]
region = us-east-1
mfa_serial = arn:aws:iam::012345678901:mfa/glennpratt

aws-cli never asks for an MFA token and I don't receive IAM permissions granted to MFA users. Here's the policy:

{  
    "Version":"2012-10-17",
    "Statement":[  
        {  
            "Condition":{  
                "NumericLessThan":{  
                    "aws:MultiFactorAuthAge":"43200"
                }
            },
            "Action":"*",
            "Resource":"*",
            "Effect":"Allow"
        }
    ]
}

And the error:

aws iam create-access-key --profile test --user glenn.pratt

A client error (AccessDenied) occurred when calling the CreateAccessKey operation: User: arn:aws:iam::012345678901:user/glennpratt is not authorized to perform: iam:CreateAccessKey on resource: user glennpratt

If I add a role_arn, then aws-cli asks for an MFA token and assumes role, but we want to grant user permissions without assuming a role.
@jamesls
Copy link
Member

jamesls commented May 24, 2016

Marking as a feature request. The CLI currently does not support this, but it would be nice to have.

@jamesls jamesls added the feature-request A feature should be added or improved. label May 24, 2016
@ksperling
Copy link

Those waiting for this feature might want to have a look at https://github.com/lonelyplanet/aws-mfa (unfortunately it seems unmaintained).

One feature I would particularly like in this context is to be able to spawn a sub-shell via a command like aws shell such that the temporary credentials are only cached in the environment of that shell process rather than written to disk. This feature would also be beneficial in the context of assume role.

@ksperling
Copy link

I've implemented a shell script called aws-session that prompts for MFA credentials and makes them available in an interactive shell (think sudo -s for AWS).

At the moment it only supports STS GetSessionToken, but I may add AssumeRole support as well. One difference compared to the native AssumeRole support in the CLI is that the temporary credentials (intentionally) do not get persisted, so they can easily be discarded just by closing the shell.

@pwaller
Copy link

pwaller commented Jan 7, 2017

I've also written something called aws-creds which caches credentials (or can be used to invoke a shell with the credentials in it) and also supports AssumeRole. I think there are a few of these out there, I already know two other organisations which have their own scripts for doing this. It would be great to see this implemented in the official tooling.

@abn abn mentioned this issue Jun 4, 2017
Closed
@ASayre
Copy link
Contributor

ASayre commented Feb 6, 2018 •
edited
Loading

Good Morning!

We're closing this issue here on GitHub, as part of our migration to UserVoice for feature requests involving the AWS CLI.

This will let us get the most important features to you, by making it easier to search for and show support for the features you care the most about, without diluting the conversation with bug reports.

As a quick UserVoice primer (if not already familiar): after an idea is posted, people can vote on the ideas, and the product team will be responding directly to the most popular suggestions.

We’ve imported existing feature requests from GitHub - Search for this issue there!

And don't worry, this issue will still exist on GitHub for posterity's sake. As it’s a text-only import of the original post into UserVoice, we’ll still be keeping in mind the comments and discussion that already exist here on the GitHub issue.

GitHub will remain the channel for reporting bugs.

Once again, this issue can now be found by searching for the title on: https://aws.uservoice.com/forums/598381-aws-command-line-interface

-The AWS SDKs & Tools Team

This entry can specifically be found on UserVoice at: https://aws.uservoice.com/forums/598381-aws-command-line-interface/suggestions/33168322-support-mfa-without-assume-role

@ASayre ASayre closed this as completed Feb 6, 2018
@salmanwaheed
Copy link

salmanwaheed commented Feb 6, 2018 via email

@salmanwaheed
Copy link

salmanwaheed commented Feb 6, 2018 via email

@jamesls
Copy link
Member

jamesls commented Apr 6, 2018

Based on community feedback, we have decided to return feature requests to GitHub issues.

@jamesls jamesls reopened this Apr 6, 2018
@kyleknap kyleknap mentioned this issue Apr 12, 2018
Closed
@ahl
Copy link

ahl commented Dec 1, 2018 •
edited
Loading

Seems like a dupe of aws/aws-sdk#529 and #3174

@tb3088
Copy link

tb3088 commented Dec 15, 2018

With AWS Professional Services incessantly pushing MFA and heavy use of account separation and assume-role and friends, the least the tools team could do is keep up, eh?

@tb3088
Copy link

tb3088 commented Dec 16, 2018

this is a common IAM template fragment that the lack of support means things get annoying, fast. A more complete example.

        {
            "Sid": "BlockMostAccessUnlessSignedInWithMFA",
            "Effect": "Deny",
            "NotAction": [
                "iam:GetAccountSummary",
                "iam:ListAccountAliases",
                "iam:ListUsers",
                "iam:ListServiceSpecificCredentials",
                "iam:ListMFADevices",
                "iam:EnableMFADevice",
                "iam:ResyncMFADevice",
                "iam:ListVirtualMFADevices",
                "iam:CreateVirtualMFADevice",
                "iam:DeleteVirtualMFADevice",
                "sts:GetSessionToken"
            ],
            "Resource": "*",
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "false"
                }
            }
        }

@cornfeedhobo
Copy link

cornfeedhobo commented Dec 26, 2018 •
edited
Loading

Please implement this, like, yesterday.
#3174
boto/botocore#1399

@whereismypen
Copy link

How can this not be merged by now? The solution is waiting here. As the others here have said, this would be a great aid in time and a step up in security.

@Angelin01
Copy link

6 years later and this is not supported. Thousands of mini shell scripts using sts assume-role and similar solutions just to get around this.

People will only implement extra protections if it is a good trade off between convenience and added security, and as of right now using MFA on the CLI is a huge inconvenience because of this and #3174. Having worked with a lot of folks using AWS, I can count on my fingers how many permanently adopted MFA for the CLI, and of those who did everyone hacked together some sort of alternative solution to this exact issue.

@irl-segfault
Copy link

Agreed that it's strange to not have been fixed yet, however at least you can have MFA work (be prompted for) as long as the profile you're using assumes a role. Temp credentials are stored in ~/.aws/cli/cache, so you don't need a wrapper/scaffold script to update your ~/.aws/credentials file. Having users interact with the API via a Role is a better practice anyways, though I feel everyone's pain.

@tb3088
Copy link

tb3088 commented Apr 5, 2022

I do all that - look at cache, etc. in my scripts. The point is there should NOT be an assume-role required for MFA to be invoked. It's a bogus dependency that the API writers just jammed in there without thinking. The API writers have some glaring blind spots - namely naming consistency for starters.

@irl-segfault
Copy link

I don't disagree, just saying there's an easy workaround -- create a role, allow your user to assume the role, and add the roleARN to your ~/.aws/credentials until this is fixed. Agree it's not necessary / confusing.

@justindho justindho linked a pull request May 17, 2022 that will close this issue
Add configure mfa command #2636
Closed
@justindho justindho removed a link to a pull request May 17, 2022
Add configure mfa command #2636
Closed
@AndreZiviani AndreZiviani mentioned this issue May 18, 2022
Merged
@tim-finnigan tim-finnigan mentioned this issue May 24, 2022
Open
@whereismypen
Copy link

Another quarter has lapsed and still nothing. No update, no progress, not even a promise. Even Google supports MFA on gcloud (with token even 👍 ).

@sebandgo
Copy link

sebandgo commented Sep 1, 2022

It's becoming embarrassing 🤦.
A 6 years old feature request, oh dear...

@tim-finnigan tim-finnigan added p2 This is a standard priority issue needs-review This issue or pull request needs review from a core team member. labels Nov 15, 2022
@whereismypen
Copy link

Another quarter and this hasn't made any progress. Decision makers should consider this when choosing platforms.
@SebastianGogoasa - It's past embarrassing.

@sebandgo
Copy link

@whereismypen agree. I bet @glennpratt who originally raised this issue back in 2016 is very close to its retirement age.

I may be wrong but my guess is that AWS is working on a DNA based type of authentication for its CLI and I don't think we'll need this feature anymore... no more MFA, ADFS and all that non-sense.

That was a joke, but seriously this is a matter of security. What's the point in setting up MFA for the console when most of the developers are using the CLI on a daily basis.

@gitnik
Copy link

gitnik commented Aug 18, 2023

Let's try it again. More than 6 months later

@cornfeedhobo
Copy link

After more life experience, here is my $0.02:

Any company that has a big enough budget to get AWS to assign developer hours, is not using MFA directly in this way.

If you feel differently and work at a big company, then you will need to email this issue to your account's solution architect. That is the only way this will get attention. Don't hesitate. That's what they are there for.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
community contribution-ready feature-request A feature should be added or improved. needs-review This issue or pull request needs review from a core team member. p2 This is a standard priority issue
Projects
AWS CLI Community Contributions
Status: Contribution Ready
Milestone
No milestone
Development

No branches or pull requests