No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

You don't enable MFA on CLI: you use MFA to get a new access key ID, secret key and session token. Then you use those in the CLI. Pulumi isn't involved in that part.

You can use the AWS CLI to get the new values, and then set them into a profile or just the usual environment variables, and Pulumi will use them.

You can use `aws sts get-session-token` to get the values. Docs are here: <https://docs.aws.amazon.com/cli/latest/reference/sts/get-session-token.html>

Thanks <@U012UJTT55M> for the reply. I understand that this is not related to Pulumi. The issue with my aws cli is I didn’t need to supply MFA to get a session token and I was able to use this token to run Pulumi and import other resources. However I could not do the same when importing a role (getting the error above). I googled it and it looks like the issue is I didn’t enable MFA somehow in my aws cli profile. However the user that’s linked to the access key/secret for the profile has MFA enabled and I had to type in the code every time I log in through the console.

Okay, then the user's access key id and secret key cannot be used directly with Pulumi, because that user has MFA enabled. You need to use that user's access key with `aws sts get-session-token`, which gives you a new access key id, secret key and session token. Those are the values you use with Pulumi. And you need to change them every hour (or 24 hours or whatever you have configured as your session length).

I don't know why it worked for the older resources: perhaps your AWS policy has recently changed to require MFA?

_the user’s access key id and secret key cannot be used directly with Pulumi, because that user has MFA enabled_
I think this is not the issue? I’m still using the same access key/secret for the user and have been using it. Somehow I’ve been able to log in using this set of credentials alone without MFA even though I have MFA enabled for the IAM user. There’s no recent changes to my AWS policy (this is my personal account). From <https://github.com/hashicorp/terraform-provider-aws/issues/23617#issuecomment-1071247886|what I gathered> when accessing IAM resources I need to use MFA. But in my case it’s not even asking for a MFA code. I’ll spend more time on it afterwards. Thanks again for your hep!

fixed by running this
```aws configure set mfa_serial arn-to-device```

Yep I think it links my local cli to the mfa device somehow. surprised it’s hardly mentioned in enabling mfa doc :face_palm: . doc talks about console log in with mfa..