• outline

Using AWS CLI under MFA, you need session token and temporary AWS Access key and Secret key.

• how-to

# aws sts get-session-token --duration-seconds 10000 --serial-number "arn:aws:iam::111111111:mfa/mfa_user" --token-code 123456
{
    "Credentials": {
        "AccessKeyId": "ABCDQWEQWEQWEQWE",
        "SecretAccessKey": "YWEesaldkjsadlkgjasgsdgsadgsadgsadgsadg",
        "SessionToken": "sadfsdfsdfsadf/asdfsadfsdfsadfsadf/v//////////sdfgdsfgdfg+dsfgdsfgsdfg/dsfgsdfgsdfg/FG3TNqkzC2gQm6OPMN28y64GOpcBH20CXZNG4+dsfgdsfgsdfgsdfg/sdfgdsfgdsfgdsfg+sdfgsdfgdsfg+sdfgsdfgsdfgdsfg==",
        "Expiration": "2024-02-19T12:12:12+00:00"
    }
}

# export AWS_ACCESS_KEY_ID=ABCDQWEQWEQWEQWE
# export AWS_SECRET_ACCESS_KEY=YWEesaldkjsadlkgjasgsdgsadgsadgsadgsadg
# export AWS_SESSION_TOKEN=sadfsdfsdfsadf/asdfsadfsdfsadfsadf/v//////////sdfgdsfgdfg+dsfgdsfgsdfg/dsfgsdfgsdfg/FG3TNqkzC2gQm6OPMN28y64GOpcBH20CXZNG4+dsfgdsfgsdfgsdfg/sdfgdsfgdsfgdsfg+sdfgsdfgdsfg+sdfgsdfgsdfgdsfg==

• reference

https://repost.aws/knowledge-center/authenticate-mfa-cli

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sts/get-session-token.html

https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_access-denied.html