U2F Support

[lrvick]

Per the AWS blog U2F is now supported for Console login:
https://aws.amazon.com/blogs/security/use-yubikey-security-key-sign-into-aws-management-console/

It is especially critical there be a path to support this on the aws-cli so we can tap to perform commands instead of having long lived tokens on disk/memory.

[JensRantil]

AFAIK, U2F generally only works in a web browser. How would you expect it to be used from CLI? Fire up a browser?

[nicoonoclaste]

@JensRantil Nope, any sort of application can interact with a U2F token.

Source: I maintain libu2f-* and pam-u2f in Debian ;)

[JordonPhillips]

Looks like U2F isn't supported for API access yet:

You cannot use MFA-protected API access with U2F security keys.

That said, I've definitely passed this feedback on to the service team. My own experience has been that U2F is 100000x more useable than any other second factor so I'd love to see it even for my own use.

The one caveat is that this would need to be a V2 feature since I'm fairly certain we have to pull in c dependencies to interact with the u2f token.

[nicoonoclaste]

@JordonPhillips FYI, there is a Python U2F host library from Yubico; it's itself 100% Python, but depends on hidapi, which IIRC uses libusb and libudev.
OTOH, it's already available in all major distros, so that shouldn't be a big deal?

It would also require (like any use of U2F) that the user can interact with the U2F device; Yubico maintains udev rules upstreams in libu2f-host, that I shipped in Debian as libu2f-udev (so they can be installed without pulling in the C library), which is a dependency of task-desktop (starting in Debian 10 “buster”), so most users will have it installed out of the box; in stretch (the current Debian stable), we shipped the udev rules for U2F in the udev package, so it's available there too.
TL;DR: Debian should have the right permissions for U2F devices in jessie onwards (released over a year ago), and so should all Debian derivatives (unless they went out of their way to break U2F...)

[jeffparsons]

This would be hugely helpful for me. Getting out my phone 10-20 times a day to copy TOTPs is not fun. 😅 If I could just tap my Yubikey instead, my aws-cli experience would be so much more pleasant.

[JordonPhillips]

@nbraud it looks like the python interface they use doesn't provide linux wheels, so installing that would require that the user has a compiler installed. This isn't currently a requirement to install the cli, so adding that library would be a breaking change for many users.

[jeffparsons]

@JordonPhillips Regarding introducing a breaking change... I can imagine a couple of approaches that would let enthusiastic users benefit from this early without breaking things for less adventurous users:

1. Make it an optional dependency in v1, and then people who really care about it can compile with a special flag to enable it. In this way they opt in to "previewing" what will eventually be part of the v2 client by default.

2. Split the U2F piece into a separate binary, and detect its presence at runtime. Then users who attempt to use the AWS CLI with U2F would be told "install this other tool" to make it work. So, on Mac, for example, I would be one brew install aws-cli-u2f away from bliss. 😃

[djrodgerspryor]

Yeah, I'd be more than happy to install an optional compile-from-source module to get this functionality. It would only be needed on developer machines — which would almost always have a compiler already — and not on servers anyway.

[jeamland]

An alternative to python-u2f-host would be python-fido2 which gets you out from needing the C libraries for USB HID and means you only need the Cryptography library which ships wheels...