AWS_SESSION_TOKEN is ignored resulting in UnauthorizedOperation
Author: remipichonCreated Oct 12, 2018Updated Jun 24, 2022
summary
aws-shell doesn't seem to read the AWS_SESSION_TOKEN from the envs.
I recently switched to MFA for CLI which now prevents me to use aws-shell.
AWS configuration
aws server side details
- a main account with my user
- a secondary account to be accessed using an assumed role that enforce MFA
.aws/config
[default]
region = eu-west-1
output = json
[profile dev]
role_arn = <redacted>
credential_source = Environment
region = eu-west-1
output = json- environment
$ env | grep AWS
AWS_SESSION_TOKEN=<redacted>
AWS_SECRET_ACCESS_KEY=<redacted>
AWS_ACCESS_KEY_ID=<redacted>Actual behaviour
$ aws-shell --profile dev
aws> ec2 describe-instances
An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.same issue using
.profile
$ aws-shell
aws> .profile dev
Current shell profile changed to: dev
aws> ec2 describe-instances
An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
aws>Expected behaviour
$ aws-shell --profile dev
aws> ec2 describe-instances
{
"Reservations": []
}Debug using aws cli
$ aws --profile dev ec2 describe-instances
{
"Reservations": []
}Steps to reproduce
- enable MFA on an assumed role
- get temporary token using
aws sts get-session-token --serial-number arn:aws:iam::<account>:mfa/<username> --token-code <mfa-token> - store them in ENV and configure profile credential source to be Environment
Source: awslabs/aws-shell