aws sts get-session-token ... --token-code ... fails with InvalidClientTokenId, but MFA console login working

user_8689045 0
Viewed 4561

I am trying to retrieve session token on the AWS CLI like so:

aws sts get-session-token --serial-number arn-string --token-code mfacode

where

  • arn-string is copied from the IAM management console, security credentials for the assigned MFA device,format like arn:aws:iam:<number>:mfa/<name>
  • mfacode is taken from the registered virtual mfa device

error:

An error occurred (InvalidClientTokenId) when calling the GetSessionToken operation: The security token included in the request is invalid.

However, I use that MFA device to login to the console in the browser just fine

I have only a default profile in my ~/.aws/, but I don't see how this would have any influence.

tried this:

  1. try multiple time to ensure no mfa flip-over has happened
  2. delete MFA device assignment and reassign device -- same error
  3. ommitting --token-code in hope to have it prompt me for the MFA device token -- same error
  4. using the arn:aws:iam:<number>:user/<name> -- same error as can be expected since the aws get-session-id help clearly states it needs to be the arn of the mfa device

I figure this has to do with arn-string rather than the token, but what ? Any idea on what causes this problem most welcome.

Regards, Olaf

multi-factor-authentication aws-cli amazon-web-services
1 Answers

Solved. maafk's comment nails it down. For the records and to the next poor soul stumbling into this problem:

The profile used must have themfa_serial entry. In my case added the arn-string for the mfa-device to my local default profile in ~/.aws/config like so:

[default]

region = eu-central-1

mfa_serial = arn:aws:iam:<number>:mfa/<name>

This string can be found in the console, IAM service under the user, security credentials.

user_86890450
Related