boto/boto — pull request #1563 by WrathOfChris (2013-06-17 21:05:05+00:00)
Title: add MFA as option to sts.assume_role()

IAM role policies may require that the user authentication using MFA, but sts.assume_role does not allow passing in the session_token from sts.get_session_token

For example, an IAM role policy that requires "Condition": { "Null": { "aws:MultiFactorAuthAge": "False" } }

SecurityToken is an allowed common parameter from: http://docs.aws.amazon.com/STS/latest/APIReference/CommonParameters.html

Patch adds security_token to sts.assume_role in similar style to connect_ec2()

ex:

# connect to STS as user, use MFA to get session token
sts = boto_connect_sts()
tok = sts.get_session_token(mfa_serial_number = 'arn:aws:iam::123456789:mfa/wrathofchris', mfa_token='123456')

# use session token to re-connect to STS for role assumption
rolests = boto_connect_sts(tok.access_key, tok.secret_key)
roletok = rolests.assume_role('arn:aws:iam::123456789:role/myrole', 'wrathofchris', security_token=tok.session_token)