Skip to main content

AWS CLI with MFA

To authenticate the AWS CLI or SDK using MFA, you must invoke the AWS Security Token Service (STS) GetSessionToken API operation. This endpoint accepts your static security credentials, a hardware or virtual MFA device serial ARN string, and your current timed OTP code token. In return, STS drops a temporary credential group containing a unique Access Key, Secret Key, and a mandatory Session Token string that expires automatically.

Hands On​

Phase 1: Provision and Map the MFA Token Device​

  • Log inside the AWS Management Console and navigate to the IAM Dashboard.
  • Click on your specific active IAM User profile configuration panel (e.g., rendy).
  • Select the Security Credentials tab and scroll down to locate the Multi-factor authentication (MFA) block.
  • Click Assign MFA device and select Virtual MFA device (using apps like Google Authenticator or Authy). Click continue.
  • Click Show QR code, scan the graphical matrix with your mobile device app, and type your two consecutive timed verification code sequences into the prompts.
  • Click Assign MFA to complete the linkage.
  • 📋 Critical Step: Copy the unique hardware coordinate identifier string for your new device from the dashboard (the MFA Serial ARN). It will match this structural layout pattern:
MFA Device Serial ARN=arn:aws:iam::123456789012:mfa/your-username\text{MFA Device Serial ARN} = \text{arn:aws:iam::123456789012:mfa/your-username}

Phase 2: Execute the STS Cryptographic Handshake​

  • Open your computer's terminal shell and write out the explicit STS session request script command:
aws sts get-session-token --serial-number YOUR_COPIED_MFA_ARN_HERE --token-code YOUR_CURRENT_6_DIGIT_APP_CODE
  • The API JSON Response: If your code numbers match correctly before the 30-second rotation window expires, the command will return a JSON block containing your temporary Credentials object block.
{
  "Credentials": {
    "AccessKeyId": "ASIAIOSFODNN7EXAMPLE",
    "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "SessionToken": "FwoGZXIvYXdzEOb//////////wEaM...[EXTREMELY LONG STRING]",
    "Expiration": "2026-06-04T08:59:13Z"
  }
}
note

Notice that temporary access key string tokens generated by STS always start with the ASIA prefix, where as your static permanent IAM user keys start with AKIA.

Phase 3: Bind the Temporary Session Tokens to a Named Profile​

-To use these ephemeral credentials without breaking your base system profile configs, generate a separate, isolated profile container:

aws configure --profile mfa
  • Map the Input Prompt Array:
    • AWS Access Key ID: Paste the temporary AccessKeyId string starting with ASIA.
    • AWS Secret Access Key: Paste the temporary SecretAccessKey string payload.
    • Default region / output format: Fill these or press enter to match your project variables.

Phase 4: Enforce the Session Token Parameter​

  • Because standard aws configure inputs only capture access and secret strings, you must manually inject the session token parameter string to authenticate successfully.
  • Open your local credential file in an editor: ~/.aws/credentials
  • Find your bracketed [mfa] profile block and append the custom aws_session_token variable assignment parameter directly beneath your key listings:
[mfa]
aws_access_key_id = ASIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
aws_session_token = FwoGZXIvYXdzEOb//////////wEaM...[PASTE EXTREMELY LONG TEXT TOKEN HERE]
  • Save and exit the file.

Phase 5: Execute Authenticated API Calls​

  • Fire a test API call out over the network to verify your credential access mapping, ensuring you append the explicit --profile flag pointing to your new mfa layer:
aws s3 ls --profile mfa
  • The Result: The terminal successfully lists your bucket contents! Your terminal calls are now executing under the explicit protection umbrella of a multi-factor authenticated layer for the next 1 hour until the session window automatically expires.