Skip to content

Add mfa_process config#1123

Merged
mtibben merged 4 commits intomasterfrom
add-mfa-process-config
Feb 3, 2023
Merged

Add mfa_process config#1123
mtibben merged 4 commits intomasterfrom
add-mfa-process-config

Conversation

@mtibben
Copy link
Copy Markdown
Member

@mtibben mtibben commented Feb 3, 2023

Addsmfa_process to the aws config that works similarly to credential_process.

This will allow us to remove the "pass" prompt while allowing flexibility for those who wish to use a password manager to generate TOTP tokens.

Note that use of mfa_process is generally not considered best practice - instead it is recommended that you use a dedicated device for MFA.

@mtibben mtibben merged commit 13b57fc into master Feb 3, 2023
@mtibben mtibben deleted the add-mfa-process-config branch February 3, 2023 11:56
@tavisrudd
Copy link
Copy Markdown
Contributor

Could the implementation be extended to pass mfa_process the mfa_serial for the current profile either as positional argument or as an environment variable? Alternatively, the mfa_process string could be templated or regex expanded before executing it to allow something like {{mfa_serial}} to be filled in. This would reduce clutter and typo opportunities in ~/.aws/config.

Fyi, I'm using pass otp with gpg from a yubikey so it's not the full anti-pattern you mentioned in #1006.

@mtibben
Copy link
Copy Markdown
Member Author

mtibben commented Mar 14, 2023

Environment variable seems reasonable, I'd prefer to avoid templating. Feel free to open a PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants