Skip to content

Instantly share code, notes, and snippets.

@SergiuSavva

SergiuSavva/1. aws-mfa.sh

Last active February 29, 2024 11:13
Show Gist options
  • Save SergiuSavva/cf48bcbf029619f8f1d7a6433443520d to your computer and use it in GitHub Desktop.
Save SergiuSavva/cf48bcbf029619f8f1d7a6433443520d to your computer and use it in GitHub Desktop.
Download ZIP
This Bash script helps in generating and configuring temporary AWS credentials using Multi-Factor Authentication (MFA) for added security. It reads the MFA device ARN from the specified AWS profile in the credentials file, prompts the user for the MFA token code, and then obtains the temporary credentials from AWS Security Token Service (STS). F…
Raw
1. aws-mfa.sh
#!/bin/bash
# Set the profile you want to use for MFA
SOURCE_PROFILE="default"
MFA_PROFILE="mfa"
# Read the MFA device ARN from the credentials file
MFA_DEVICE_ARN=$(aws configure get mfa_device_arn --profile $SOURCE_PROFILE)
if [ -z "$MFA_DEVICE_ARN" ]; then
echo "Error: MFA device ARN not found in the ~/.aws/credentials file for profile $SOURCE_PROFILE"
exit 1
fi
echo "Enter your MFA token code:"
read MFA_CODE
# Get the temporary credentials
CREDENTIALS=$(aws sts get-session-token \
--serial-number "$MFA_DEVICE_ARN" \
--token-code "$MFA_CODE" \
--profile "$SOURCE_PROFILE" \
--output json 2>/dev/null)
if [ $? -ne 0 ]; then
echo "Error: Failed to obtain temporary credentials. Please check your MFA token code and try again."
exit 1
fi
# Extract the credentials from the JSON response
ACCESS_KEY=$(echo "$CREDENTIALS" | jq -r '.Credentials.AccessKeyId')
SECRET_KEY=$(echo "$CREDENTIALS" | jq -r '.Credentials.SecretAccessKey')
SESSION_TOKEN=$(echo "$CREDENTIALS" | jq -r '.Credentials.SessionToken')
EXPIRATION=$(echo "$CREDENTIALS" | jq -r '.Credentials.Expiration')
# Check if the credentials are not empty
if [ -z "$ACCESS_KEY" ] || [ -z "$SECRET_KEY" ] || [ -z "$SESSION_TOKEN" ]; then
echo "Error: Failed to parse temporary credentials. Please try again."
exit 1
fi
# Store the temporary credentials in the mfa profile
aws configure set aws_access_key_id "$ACCESS_KEY" --profile "$MFA_PROFILE"
aws configure set aws_secret_access_key "$SECRET_KEY" --profile "$MFA_PROFILE"
aws configure set aws_session_token "$SESSION_TOKEN" --profile "$MFA_PROFILE"
echo "Temporary credentials have been set for the '$MFA_PROFILE' profile. They will expire on $EXPIRATION."
Raw
2. credentials
[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY
mfa_device_arn = YOUR_MFA_DEVICE_ARN
[mfa]
aws_access_key_id = ANOTHER_ACCESS_KEY
Raw
3. set permissions
# Set permissions to run the script
chmod u+x aws-mfa.sh
Raw
4. run script
# Run the script
./aws-mfa.sh
@GFoley83
Copy link

GFoley83 commented Jan 15, 2024 •
edited
Loading

Here's the equivalent of this script in PowerShell for Windows. You can alternatively pass in the MFA token as a command line argument.
e.g.
./aws-mfa.ps1 123456

# Set the profile you want to use for MFA
$SourceProfile = "default"
$MFAProfile = "mfa"

# Read the MFA device ARN from the credentials file
$MFADeviceARN = aws configure get mfa_device_arn --profile $SourceProfile
if (-not $MFADeviceARN) {
  Write-Error "Error: MFA device ARN not found in the ~/.aws/credentials file for profile $SourceProfile"
  exit 1
}

# Check if MFA code is provided as a command line argument
if ($args.Count -gt 0) {
  $MFACode = $args[0]
} else {
  Write-Host "Enter your MFA token code:"
  $MFACode = Read-Host
}

# Get the temporary credentials
$Credentials = aws sts get-session-token `
  --serial-number "$MFADeviceARN" `
  --token-code "$MFACode" `
  --profile "$SourceProfile" `
  --output json 2>$null

if ($LastExitCode -ne 0) {
  Write-Error "Error: Failed to obtain temporary credentials. Please check your MFA token code and try again."
  exit 1
}

# Extract the credentials from the JSON response
$AccessKey = ($Credentials | ConvertFrom-Json).Credentials.AccessKeyId
$SecretKey = ($Credentials | ConvertFrom-Json).Credentials.SecretAccessKey
$SessionToken = ($Credentials | ConvertFrom-Json).Credentials.SessionToken
$Expiration = ($Credentials | ConvertFrom-Json).Credentials.Expiration

# Check if the credentials are not empty
if (-not $AccessKey -or -not $SecretKey -or -not $SessionToken) {
  Write-Error "Error: Failed to parse temporary credentials. Please try again."
  exit 1
}

# Store the temporary credentials in the mfa profile
aws configure set aws_access_key_id "$AccessKey" --profile "$MFAProfile"
aws configure set aws_secret_access_key "$SecretKey" --profile "$MFAProfile"
aws configure set aws_session_token "$SessionToken" --profile "$MFAProfile"

Write-Host "Temporary credentials have been set for the '$MFAProfile' profile. They will expire on $Expiration."

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment