Can we make MFA session tokens expire in less than 12 hours?

[gerrymiller]

We are using IAM roles with CLI, as described in this article, by setting our ~/.aws/config file to look something like this:

[profile poweruser]
role_arn = arn:aws:iam::111111111111:role/PowerUser
source_profile = default
mfa_serial = arn:aws:iam::111111111111:mfa/johndoe

Is there a configuration setting we can use to make the resultant session token expire in less than the default 12 hours? I know that's an option in get-session-token (using the --duration-seconds parameter) but can't figure out if this is possible when configuring AWSCLI to prompt for an MFA code.

If this is currently not possible, it would make a great new feature!

[JordonPhillips]

There is not currently a way to set the duration-seconds of the call, but since under the hood we're using assume-role not get-session-token, the default duration is 1 hour rather than 12. I'm not sure that less than one hour is particularly useful, what do you think?

[gerrymiller]

That's awesome, thank you.