AWS MFA CLI

Simple CLI to manage AWS MFA profiles and obtain temporary session tokens.

First create static credentials and attach MFA device in AWS console.

Install from releases

Download the latest release (that corresponds to your architecture) from the Releases page and place the binary in your system PATH.

Make sure to verify the sha256sum of the downloaded binary with the one provided on the releases page.

For example, if you have a Mac with Apple Silicon:

# should match the sha256sum on the releases page
sha256sum aws_mfa_darwin_arm64

# make it executable
chmod +x aws_mfa_darwin_arm64

# remove quarantine attribute on macOS if the sha256sum matches
xattr -dr com.apple.quarantine /usr/local/bin/aws_mfa

# install it to /usr/local/bin
mv aws_mfa_darwin_arm64 /usr/local/bin/aws_mfa

# check installation
aws_mfa --version

First run create and follow the instructions:

aws_mfa --create

To also have shell completion run this:

aws_mfa --install-completion

This installs shell completion and an aws_mfa_use helper function in your shell rc file. Use it to authenticate and automatically export AWS_PROFILE in the same shell:

aws_mfa_use my-profile

To authenticate and obtain temporary session tokens run:

| Pro tip you can press tab after typing aws_mfa to see available profiles if shell completion is installed. |

aws_mfa my-profile

Also you can automatically fetch the profile name if you have already set the AWS_PROFILE environment variable:

export AWS_PROFILE=my-profile
aws_mfa

Build

To build the tool, run:

go mod tidy
go build -o aws_mfa .

Then create a new MFA-enabled profile:

./aws_mfa --create

Finally authenticate and obtain temporary session tokens:

./aws_mfa my-profile

Install to the system PATH:

mv aws_mfa /usr/local/bin/