Pulumi doesn t support aws MFA scenarios does it

Question

brave-planet-10645 · Answer

In what way As in can it bypass the MFA or do you mean you re being asked to enter the MFA when you run `pulumi up`

billowy-army-68599 · Answer

< powerful continent 32307> it does yes but you need to authenticate with MFA and retrieve a session token I can walk you through it if needed

little-cartoon-10569 · Answer

Confirm it works fine My team uses MFA with Pulumi all the time

billowy-army-68599 · Answer

< little cartoon 10569> for my own posterity what s your workflow

little-cartoon-10569 · Answer

Once a day I grab my 6 digit MFA value from BitWarden and pass it to a bash alias I have `aws2fa`

little-cartoon-10569 · Answer

For the next 24 hours I can use Pulumi slightly smiling face

little-cartoon-10569 · Answer

The alias sets up an AWS profile with the temp creds and a fixed name The AWS profile that I use with Pulumi uses that profile as its source

billowy-army-68599 · Answer

mind sharing that alias I ve recommended `aws vault` for this before

little-cartoon-10569 · Answer

The alias isn t very interesting it just invokes an image that uses this script as an entrypoint I think a colleague got the script from an AWS or Pulumi page

little-cartoon-10569 · Answer

3 profiles involved identity is the user s profile with creds that need MFA identity mfa is a temp profile set up with the creds returned by get session token and pulumi is the user s profile that refers to identity mfa and sets up the assumed role

little-cartoon-10569 · Answer

Code edited to remove hard coded account IDs untested in this version you may need to edit to get it to work