s3cmd
s3cmd copied to clipboard
Add support for STS MFA TokenCode for role_config()
I'm trying to use S3cmd with MFA enabled on my account. From the code, it looks like I should be able to set the AWS_ARN_ROLE environment variable and S3cmd will make an API request to AWS STS to retrieve the access key, secret key, and access token.
However, it looks like there's a request parameter missing:
# Custom debug statements
AWS_ROLE_ARN env: arn:aws:iam::123456789012:mfa/MFA.test
encoded params: Action=AssumeRole&RoleArn=arn%3Aaws%3Aiam%3A%3A123456789012%3Amfa%2FMFA.test&Version=2011-06-15&RoleSessionName=role-session-1629134934
response status: 403
response content: <ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
<Error>
<Type>Sender</Type>
<Code>MissingAuthenticationToken</Code>
<Message>Request is missing Authentication Token</Message>
</Error>
<RequestId>51dd3e93-6271-4d59-95b4-13c4647d0594</RequestId>
</ErrorResponse>
# S3cmd response
ERROR: /Users/michael.doogopuff.com/.s3cfg: None
ERROR: Configuration file not available.
ERROR: Consider using --configure parameter to create one.
Reading the STS documentation more closely, it looks like S3cmd would need to query the user for a six digit MFA code and attach it to the request as TokenCode, which it currently doesn't. This may be more of a feature request than a bug report.