How do I use `aws ecr get-login` with MFA enforcement enabled?

Question

I am using the aws cli, and my IAM user has full Admin rights. Our company requires MFA, so there is an MFA enforcement policy on my IAM user. To use the cli, I fetch a token using aws sts get-session-token.

This all lets me use aws cli just fine, until I try and fetch the docker login for AWS container registries. Then I get an error...

$ aws ecr get-login --registry-ids XXXXX An error occurred (AccessDeniedException) when calling the GetAuthorizationToken operation: User: arn:aws:iam::XXXXX:user/yyyyy is not authorized to perform: ecr:GetAuthorizationToken on resource: *

If I temporarily remove the MFA enforcement policy from my IAM user, then the command succeeds.

So the question is, how do I use aws ecr get-login with MFA enforcement enabled?

user_3293761 · Answer

This answer has changed a little bit. I would suggest looking at this article: https://aws.amazon.com/premiumsupport/knowledge-center/authenticate-mfa-cli/

You need to set the session and access keys in addition to the session token if you're using the CLI

How do I use `aws ecr get-login` with MFA enforcement enabled?

2 Answers