Question: How do I use an MFA token to authenticate access to my AWS resources through the AWS CLI?

I want to use an MFA token to authenticate access to my AWS resources with the AWS Command Line Interface (AWS CLI).

ResolutionIt's a best practice to protect your account and its resources by using a multi-factor authentication (MFA) device. If you plan to interact with your resources using the AWS CLI when using an MFA device, then you must create a temporary session. If you're using an MFA hardware device, then the value is similar to GAHT12345678. If you're using a virtual MFA, then the value can be found by viewing the Security credentials. It looks similar to arn:aws:iam::123456789012:mfa/user. For more information, see Checking MFA status.Important:Support for security keys is available only with the AWS Management Console. For more information, see Activating a FIDO security key (console). As a workaround, you can use a virtual MFA device. For more information, see Activating and managing virtual MFA devices (AWS CLI or AWS API).All AWS Identity and Access Management (IAM) users must have sufficient permissions to create, view, and deactivate MFA devices assigned to them as a user. They must also have an MDA device turned on and assigned to their user before beginning.If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Run the sts get-session-token AWS CLI command, replacing the variables with information from your account, resources, and MFA device:$ aws sts get-session-token --serial-number arn-of-the-mfa-device --token-code code-from-tokenYou receive an output with temporary credentials and an expiration time (by default, 12 hours) similar to the following:{    "Credentials": {        "SecretAccessKey": "secret-access-key",        "SessionToken": "temporary-session-token",        "Expiration": "expiration-date-time",        "AccessKeyId": "access-key-id"    }}Note: You can specify an expiration duration (in seconds) using the --duration-seconds option in the sts get-session-token command. The value can range from 900 seconds (15 minutes) to 129600 seconds (36 hours). If you are using root user credentials, then the range is from 900 seconds (15 minutes) to 3600 seconds (1 hour).Using temporary credentials with environment variablesYou can use temporary credentials by exporting their values to environment variables using these commands.Linux:export AWS_ACCESS_KEY_ID=example-access-key-as-in-previous-outputexport AWS_SECRET_ACCESS_KEY=example-secret-access-key-as-in-previous-outputexport AWS_SESSION_TOKEN=example-session-token-as-in-previous-outputWindows:set AWS_ACCESS_KEY_ID=example-access-key-as-in-previous-outputset AWS_SECRET_ACCESS_KEY=example-secret-access-key-as-in-previous-outputset AWS_SESSION_TOKEN=example-session-Token-as-in-previous-outputIf you set the environment variables, be sure to unset them before making the get-session-token call again using these commands.Linux:unset AWS_ACCESS_KEY_IDunset AWS_SECRET_ACCESS_KEYunset AWS_SESSION_TOKENWindows:set AWS_ACCESS_KEY_ID=set AWS_SECRET_ACCESS_KEY=set AWS_SESSION_TOKEN=Using temporary credentials with named profilesYou can also use named profiles to specify the commands that require MFA authentication. To do so, edit the credentials file in the .aws folder in the home directory of the user. In the credentials file, add a new profile configuration for issuing MFA-authenticated commands. Here's an example profile configuration:[mfa]aws_access_key_id = example-access-key-as-in-returned-outputaws_secret_access_key = example-secret-access-key-as-in-returned-outputaws_session_token = example-session-Token-as-in-returned-outputAfter the credentials expire, run the get-session-token command again, and then export the returned values to the environment variables or to the profile configuration.Tip: Try running a script or a cron job in the background that checks for "expiration" from the get-session-token command output, and then prompts for reauthentication.If the AWS CLI is configured using the configure command, there's a default configuration with permanent AWS Identity and Access Management (IAM) user credentials. This IAM user can use commands that don't require MFA authentication.Example configuration:.aws/credentials[default]aws_access_key_id = example-access-Key-for-an-IAM-useraws_secret_access_key = example-secret-access-key-for-IAM-userNote: You can't use the mfa_serial parameter with permanent IAM credentials.If you use profiles to authenticate commands using the AWS CLI, specify the --profile option followed by the profile name. This is done to verify that the calls authenticate using MFA.For example, this command uses the default profile credentials and isn't authenticated with MFA.$ aws s3 lsImportant: Be sure that you understand the credential precedence so that you can verify that correct credentials are used when making API calls. This can be done by using the GetCallerIdentity command.$ aws s3 ls --profile mfaYou can require a user to authenticate using an MFA to perform particular API actions. Use either the aws:MultiFactorAuthPresent or aws:MultiFactorAuthAge conditions in an IAM policy to accomplish this.

Related informationActivating MFA devices for users in AWSLost or unusable multi-factor authentication (MFA) device