pulumi up is not supporting MFA tokens

[josb]

Looks like there's no support for MFA tokens:

/git/pulumi/s3website% pulumi up
Previewing update (dev):

     Type                 Name               Plan     Info
     pulumi:pulumi:Stack  s3website-dev
     └─ aws:s3:Bucket     s3-website-bucket           1 error

Diagnostics:
  aws:s3:Bucket (s3-website-bucket):
    error: Error creating AWS session: AssumeRoleTokenProviderNotSetError: assume role with MFA enabled, but AssumeRoleTokenProvider session option not set.

This is with the following AWS cli config:

[default]
region = <some region>

[profile dev]
region = <some region>
role_arn = arn:aws:iam::<target account>:role/Administrator
source_profile = default
mfa_serial = arn:aws:iam::<source account>:mfa/myuser

I think this is because awsbase.GetCredentials (https://github.com/hashicorp/aws-sdk-go-base/blob/master/awsauth.go#L154) isn't using AssumeRoleTokenProvider as a session option.

[lukehoban]

This sounds like it might be hashicorp/terraform-provider-aws#5592.

[lukehoban]

BTW - I have seen several teams use tools like https://github.com/remind101/assume-role in order to assume a role (including an MFA-requiring role) as a separate step from the invocation of pulumi, which can be a workaround for issues like this if needed.

[josb]

I had to apply remind101/assume-role#38 and thus build from source to make this work, but with that, assume-role dev pulumi up worked. Still, it's only a workaround and it makes it more difficult to advocate for Pulumi.

[lukehoban]

Still, it's only a workaround and it makes it more difficult to advocate for Pulumi.

Completely agreed.

[tdi]

I can also recommend this one, which is more CI/CD firendly https://github.com/nordcloud/assume-role-arn

[josb]

@tdi thanks for the recommendation, looks nice.

[joehillen]

Is this still an issue? My security teams wants to turn on MFA, but I'm worried it is going to break my stuff.

[josb]

This has not been fixed.

[lukehoban]

This and #1366 appear to be the same issue. That one has a little more recent relevant details - so closing this one out as a duplicate.