Given the following profile:
[profile test]
region = us-east-1
mfa_serial = arn:aws:iam::012345678901:mfa/glennpratt
aws-cli never asks for an MFA token and I don't receive IAM permissions granted to MFA users. Here's the policy:
{
"Version":"2012-10-17",
"Statement":[
{
"Condition":{
"NumericLessThan":{
"aws:MultiFactorAuthAge":"43200"
}
},
"Action":"*",
"Resource":"*",
"Effect":"Allow"
}
]
}And the error:
aws iam create-access-key --profile test --user glenn.pratt
A client error (AccessDenied) occurred when calling the CreateAccessKey operation: User: arn:aws:iam::012345678901:user/glennpratt is not authorized to perform: iam:CreateAccessKey on resource: user glennpratt
If I add a role_arn, then aws-cli asks for an MFA token and assumes role, but we want to grant user permissions without assuming a role.
Given the following profile:
aws-cli never asks for an MFA token and I don't receive IAM permissions granted to MFA users. Here's the policy:
{ "Version":"2012-10-17", "Statement":[ { "Condition":{ "NumericLessThan":{ "aws:MultiFactorAuthAge":"43200" } }, "Action":"*", "Resource":"*", "Effect":"Allow" } ] }And the error:
If I add a role_arn, then aws-cli asks for an MFA token and assumes role, but we want to grant user permissions without assuming a role.