Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: explain how to use multiple MFA virtual devices for same account #39

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

kogitant
Copy link

Explains how to set up multiple "credential profiles" and "role profiles" to be able to use both Google Authenticator and Yubikey to provide TOTP for the same AWS account assuming the same target role.

Fixes #38

…files" to be able to use both Google Authenticator and Yubikey to provide TOTP.
@kogitant
Copy link
Author

If you have everything else set up correctly, but you have not added the [work-yubikey] "credential profile" to ~/.aws/credentials you will get an error like this:

vegas-credentials assume --verbose --profile=somerole@work-acc-2@y
ℹ️  Credentials: Role: =arn:aws:iam::2222222222222:role/somerole
🔧 Credentials: Cache: /Users/FrankSinatra/Library/Caches/vegas-credentials/session-cache
ℹ️  Credentials: Cache: Not found
🔧 Yubikey: OATH password cache: /Users/FrankSinatra/Library/Caches/vegas-credentials/yubikey-oath-access
🔧 Yubikey: Device Serial: 1234567890
🔧 Yubikey: OATH Account: Amazon Web Services:FrankSinatra@vegas-demo-account
ℹ️  Yubikey: device is available
🔒 Yubikey: OATH application is password protected
🔐 Yubikey: OATH password found from cache
🔑 MFA: Input Token (via CLI stdin / GUI prompt / Yubikey touch):
ℹ️  MFA: Token received via Yubikey touch
ℹ️  MFA: Token received: "123456"
ℹ️  MFA: Serial: arn:aws:iam::111111111111:mfa/FrankSinatra@virtual-yubikey-oath
panic: operation error STS: AssumeRole, exceeded maximum number of attempts, 3, failed to sign request: failed to retrieve credentials: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, exceeded maximum number of attempts, 3, request send failed, Get "http://169.254.169.254/latest/meta-data/iam/security-credentials/": dial tcp 169.254.169.254:80: connect: host is down

goroutine 1 [running]:
github.com/aripalo/vegas-credentials/internal/credentials.(*Credentials).New(0xc000330360, {0xc00044e6e0, 0x6})
/home/runner/work/vegas-credentials/vegas-credentials/internal/credentials/credentials.go:114 +0x8f1
github.com/aripalo/vegas-credentials/internal/app.(*App).Assume(0xc0006b3d38, {{0x7ff7bfeff58d?, 0x0?}})
/home/runner/work/vegas-credentials/vegas-credentials/internal/app/assume.go:56 +0x505
github.com/aripalo/vegas-credentials/cmd.glob..func3(0x1dfd900?, {0x181809b?, 0x2?, 0x2?})
/home/runner/work/vegas-credentials/vegas-credentials/cmd/assume.go:36 +0xcc
github.com/spf13/cobra.(*Command).execute(0x1dfd900, {0xc000147540, 0x2, 0x2})
/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.4.0/command.go:856 +0x67c
github.com/spf13/cobra.(*Command).ExecuteC(0x1dfdb80)
/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.4.0/command.go:974 +0x3bd
github.com/spf13/cobra.(*Command).Execute(...)
/home/runner/go/pkg/mod/github.com/spf13/cobra@v1.4.0/command.go:902
github.com/aripalo/vegas-credentials/cmd.Execute()
/home/runner/work/vegas-credentials/vegas-credentials/cmd/cmd.go:74 +0x25
main.main()
/home/runner/work/vegas-credentials/vegas-credentials/main.go:25 +0xba

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Docs: Explain how to use multiple virtual MFA devices for same account
1 participant