aws2fa is a simple command line tool to handle 2fa authentication respecting aws-cli standard patterns
Python Makefile
Switch branches/tags
Nothing to show
Clone or download
Latest commit f6cae12 Jun 6, 2017
Failed to load latest commit information.
aws2fa Fix lint errors Jun 6, 2017
.gitignore First commit Jun 3, 2017
.travis.yml Fix lint errors Jun 6, 2017
AUTHORS First commit Jun 3, 2017
CHANGELOG Bump Jun 6, 2017
COPYING First commit Jun 3, 2017 First commit Jun 3, 2017
Makefile Add release command Jun 6, 2017
README.rst Update readme Jun 4, 2017
setup.cfg First commit Jun 3, 2017 Bump Jun 6, 2017 Add profile tests Jun 6, 2017
tox.ini Fix python3 tests Jun 6, 2017



aws2fa is a simple command to handle 2fa authentication respecting aws-cli standard configuration.


$ aws2fa [profile]
2FA device serial number for profile 'default': arn:aws:iam::123456789:mfa/username
2FA code: 123456
Sucesss! Your token will expire on: 2017-06-04 09:08:27+00:00

Now you can use aws-cli or any aws library which uses ~/.aws/credentials standard configuration.


  • aws2fa respects aws-cli configuration. No magic, no duplicated credentials.
  • Full integration with aws-cli profiles
  • Smooth device handling
  • Super minimal implementation


Simply run:

$ pip install aws2fa

We assume you have previously installed and configured aws-cli:

$ pip install awscli
$ awscli configure

Configuration conventions

aws2fa handles this automatically for you. You don't need to worry about this.

  • $profile::source-profile: A profile with this name will be created to store your original credentials.
  • $profile: This profile will contain the temporal credentials for the duration of your session.

AWS configuration

  • Create a user in the IAM console

  • Create and attach a policy which defines a explicit deny to all actions and resources if a multi-factor device is not present (Documentation about explicit-deny.):

        "Version": "2012-10-17",
        "Statement": [
                "Effect": "Deny",
                "Action": "*",
                "Resource": "*",
                "Condition": {
                    "BoolIfExists": {
                        "aws:MultiFactorAuthPresent": false
  • Attach any other custom or aws-provided policy to the user that you want allow access to.


Another option would be to use what Andreas Wittig describes in his article Improve AWS security: protect your keys with ease. The idea behind, is to instead of doing a explicit-deny on all resources or actions (if a 2fa token has not been used), you just allow the user to assume a role if a 2fa device is present.

Then, after creating different roles, you can configure aws-cli to assume certain roles when you use certain profiles.

I can see why this approach is interesting for many cases, but I believe following the explicit deny approach is more straight forward for many others.

Helpful Links


  • Fork the repository on GitHub.
  • Write a test which shows that the bug was fixed or that the feature works as expected.
    • Use tox command to run all the tests in all locally available python version.
  • Send a pull request and bug the maintainer until it gets merged and published. :).