MultiFactorAuthentication failed when using specific profile (--profile)

[HieronyM]

I tried to use different profile when running custodian command.

Command:
custodian run -s output -r all --cache-period 0 -p policy-name -d rds/rds-postgres.yml --profile="profile-name"

It always return ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: MultiFactorAuthentication failed with invalid MFA one time pass code.

I have put my AWS config both in ~/.aws/config & ~/.aws/credentials that contain the profile.
Is this a known bug or I missing something?

Currently I have workaround by using awsudo to use specific profile
awsudo -u profile-name custodian run -s output -r all --cache-period 0 -p policy-name -d rds/rds-postgres.yml

Thank you.

[kapilt]

if you have an mfa setup, authenticate to your account before running custodian, and if its in a profile set AWS_DEFAULT_PROFILE env or --profile, custodian is just using the sdk in that regard.

[HieronyM]

@kapilt ,

Yeah, It will try to authenticate first because It's asking the MFA passcode,
What I didn't know is why --profile option in custodian command always fail to accept the passcode, even if I put right passcode.

Regards.