Study guide

Technical reference and lesson notes

Purpose of This Lesson

This lesson demonstrates how to require multi-factor authentication when using the AWS Command Line Interface (AWS CLI). Instead of continuing to use long-lived access keys stored in the local AWS credentials file, the workflow obtains session credentials through AWS Security Token Service (AWS STS) using a virtual MFA device.

The resulting credentials are placed in environment variables and used by the AWS CLI for subsequent commands.

Key Concepts

AWS CLI configuration: Running aws configure normally stores an access key ID and secret access key in a local credentials file. These are long-lived credentials and may be stored in plain text.
AWS STS: AWS Security Token Service provides temporary session credentials through the aws sts get-session-token command.
Virtual MFA device: The MFA device associated with an IAM user is identified by its serial number or ARN-like identifier. The current one-time code from the device is supplied as the token code.
Session credentials: The STS response contains three values:
Access key ID
Secret access key
Session token
Environment variables: The AWS CLI can use credentials supplied through environment variables instead of the local credentials file.
Credential precedence in this workflow: After the credentials file is removed, the CLI successfully uses the environment variables. Removing those variables causes the CLI to lose access until the credentials file is restored.

MFA-Authenticated AWS CLI Workflow

1. Identify the virtual MFA device

For the IAM user, open the Security credentials area and locate the enabled virtual MFA device. Copy its identifier for use as the --serial-number value.

The serial number must correspond to the MFA device associated with the user whose credentials are being used to request the STS session token.

2. Start with credentials capable of calling STS

The AWS CLI must have some credentials available before it can call STS. These initial credentials do not necessarily need broad account-management permissions. They can be restricted to the minimum permissions required to make the session-token API call.

The demonstration begins with credentials in the local AWS credentials file, but the goal is to stop relying on that file after the MFA-authenticated session credentials have been obtained.

3. Request session credentials with MFA

Use the AWS CLI command below, replacing the serial number and token code with values from the account and MFA device:

aws sts get-session-token \
  --serial-number <virtual-mfa-device-serial-number> \
  --token-code <current-mfa-token>

The command returns temporary credentials containing an access key ID, secret access key, and session token.

This exercise is performed with the AWS CLI installed on a local computer. The lecture specifically notes that AWS CloudShell cannot be used for this exercise.

4. Export the returned values

On Linux or macOS, assign the three returned values to environment variables:

export AWS_ACCESS_KEY_ID="<access-key-id>"
export AWS_SECRET_ACCESS_KEY="<secret-access-key>"
export AWS_SESSION_TOKEN="<session-token>"

On Windows, use set instead of export according to the demonstrated workflow:

set AWS_ACCESS_KEY_ID=<access-key-id>
set AWS_SECRET_ACCESS_KEY=<secret-access-key>
set AWS_SESSION_TOKEN=<session-token>

The session token is required in addition to the access key ID and secret access key. Omitting it means the complete STS session credentials are not configured.

5. Validate that the CLI uses the session credentials

After setting the environment variables, remove or move the original credentials file and run a test command such as:

aws s3 ls

If the command succeeds without the credentials file, the CLI is using the environment variables containing the STS credentials.

6. Remove the environment variables

To remove the temporary variables in Linux or macOS:

unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN

After unsetting them, AWS CLI commands fail when no other credential source is available. Restoring the backed-up credentials file makes the original access keys available again.

Exam- or Assessment-Relevant Takeaways

When a scenario requires MFA for AWS CLI access, recognize the pattern of using aws sts get-session-token with --serial-number and --token-code.
The MFA serial number identifies the virtual MFA device; it is not the one-time token code.
The token code is the current code generated by the virtual MFA device.
STS returns three values that must be configured together: access key ID, secret access key, and session token.
Environment variables can allow the AWS CLI to operate without a credentials file.
The credentials used to call STS must already have enough permission to make that API call, but the lecture emphasizes restricting them to the minimum necessary access.
Know the platform distinction shown in the lesson: Linux/macOS use export and unset; Windows uses set for the demonstrated variable assignment.
This workflow uses a local AWS CLI installation rather than CloudShell.

Tool / Feature Decision Guide

Situation	Appropriate choice	Reason
Need to obtain CLI credentials after presenting MFA	`aws sts get-session-token`	Requests STS session credentials using the MFA device identifier and current token code.
Need to identify which MFA device to submit	Virtual MFA device serial number	The serial number maps the request to the user’s registered MFA device.
Need to supply the current MFA proof	`--token-code`	The value comes from the current code generated by the virtual MFA device.
Need to avoid using the local credentials file after authentication	Environment variables	The AWS CLI can use the returned access key ID, secret access key, and session token from the process environment.
Need to stop using the environment-based session	`unset` on Linux/macOS	Removes the variables so those credentials are no longer available to the CLI process environment.
Need to run this specific hands-on workflow	Local AWS CLI	The lesson explicitly states that CloudShell cannot be used for the exercise.

Common Traps / Misconceptions

Confusing the serial number with the token code: The serial number identifies the MFA device; the token code is the current one-time value generated by that device.
Configuring only two credentials: STS session authentication requires the access key ID, secret access key, and session token. The session token is not optional in this workflow.
Assuming MFA removes the need for initial credentials: Credentials are still required to make the STS API call. MFA adds the authentication factor used to obtain the session credentials.
Leaving the original credentials file in use: The purpose of the demonstration is to validate that commands can run using environment variables after the credentials file is removed.
Forgetting shell syntax differences: export and unset are used in Linux/macOS examples, while the Windows assignment shown uses set.
Trying to perform the exercise in CloudShell: The lecture specifies using the AWS CLI on a computer instead.
Assuming environment variables are permanent configuration: The demonstration treats them as values set in the current shell environment; unsetting them removes their availability to the CLI.

Real-World Engineer / Analyst Notes

Avoid treating long-lived access keys in a local credentials file as the default solution when an MFA-protected workflow is required.
Keep the credentials used to request the STS token narrowly scoped to the minimum access needed to make that API call.
Preserve the complete STS response while configuring the environment variables. The access key ID, secret access key, and session token form one credential set.
Validate the active credential source deliberately: remove or move the credentials file, run a harmless read-oriented command such as aws s3 ls, and confirm that the command still works.
Clean up the environment variables when the session should no longer be used. This prevents the current shell from continuing to provide those values to later AWS CLI commands.
Do not place real access keys, secret keys, session tokens, or live MFA codes in notes, scripts, or shared logs.

Quick Reference Summary

1. Locate the user's virtual MFA device serial number.
2. Ensure the local AWS CLI has restricted credentials capable of calling STS.
3. Run:
   aws sts get-session-token \
     --serial-number <mfa-serial-number> \
     --token-code <current-mfa-code>
4. Capture the access key ID, secret access key, and session token.
5. Set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN.
6. Remove or move the credentials file.
7. Test with: aws s3 ls
8. Remove variables with unset when finished.

Flashcards

Q: A user must run AWS CLI commands with MFA, and the workflow should not depend on long-lived credentials remaining in the credentials file. Which AWS capability should be used?

A: Use aws sts get-session-token with the virtual MFA device serial number and current token code. It returns session credentials that can be supplied through environment variables.

Q: What is the difference between the MFA serial number and the token code in an STS request?

A: The serial number identifies the registered virtual MFA device. The token code is the current value generated by that device.

Q: Which three values must be configured from the get-session-token response?

A: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. The session token must be included with the access key and secret key.

Q: Why does the AWS CLI still need credentials before it can request an MFA-authenticated session token?

A: The CLI must authenticate the STS API call itself. Those initial credentials can be restricted to the minimum permissions needed to make that call.

Q: After setting STS credentials as environment variables, what test demonstrates that the credentials file is not being used?

A: Move or remove the credentials file and run aws s3 ls. If it succeeds, the CLI is obtaining credentials from the environment variables.

Q: When would you use environment variables instead of the local AWS credentials file in this workflow?

A: Use environment variables after obtaining the MFA-protected STS session so the CLI can operate without the original long-lived credentials file.

Q: What is the Linux/macOS command to remove the three AWS credential environment variables?

A: Use unset AWS_ACCESS_KEY_ID, unset AWS_SECRET_ACCESS_KEY, and unset AWS_SESSION_TOKEN.

Q: What shell syntax difference does the lesson identify for Windows credential-variable assignment?

A: The Windows example uses set rather than export for assigning the variables.

Q: A CLI user supplies the correct access key ID and secret access key from STS but omits the session token. What is the problem?

A: The STS credential set is incomplete. The session token must be supplied along with the access key ID and secret access key.

Q: Why should the credentials used to call STS be restricted?

A: They only need enough permission to make the session-token API call. Restricting them reduces the access associated with the initial long-lived keys.

Q: What happens in the demonstrated environment after the AWS credential variables are unset and the credentials file is absent?

A: AWS CLI commands no longer have credentials and fail. Credentials can be made available again by restoring the backed-up credentials file or obtaining another session.

Q: Which local tool is required for the hands-on exercise, and which environment is explicitly excluded?

A: Use the AWS CLI installed on a computer. The lecture explicitly says not to use AWS CloudShell for this exercise.

Practice Questions

Question 1

An engineer runs aws sts get-session-token with an MFA token but receives an error because the device reference is wrong. Which value should they verify first?

A. The S3 bucket name
B. The virtual MFA device serial number
C. The AWS_SESSION_TOKEN environment variable
D. The local AWS region

Correct answer: B. The virtual MFA device serial number

The serial number identifies the virtual MFA device associated with the user. The token code is a separate value supplied from that device.

Question 2

An engineer receives an STS response and configures only AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. What should they do next?

A. Add AWS_SESSION_TOKEN from the same STS response
B. Delete the virtual MFA device
C. Run aws configure to overwrite the values
D. Use CloudShell instead of the local CLI

Correct answer: A. Add AWS_SESSION_TOKEN from the same STS response

The demonstrated STS credential set consists of all three values: access key ID, secret access key, and session token.

Question 3

A tester wants to prove that the AWS CLI is using MFA-derived environment credentials rather than the local credentials file. Which sequence is best?

A. Run aws configure and then inspect the credentials file
B. Set the three STS variables, remove the credentials file, and run aws s3 ls
C. Unset the variables and run aws sts get-session-token without credentials
D. Copy the MFA token code into the credentials file and run aws s3 ls

Correct answer: B. Set the three STS variables, remove the credentials file, and run aws s3 ls

Removing the file while the command still succeeds demonstrates that the CLI is using the environment-based session credentials.

Question 4

A security-focused team wants the initial access keys used for the STS request to have the smallest possible scope. What approach matches the lesson?

A. Grant administrator access because MFA is enabled
B. Give the keys only the permissions needed to make the STS API call
C. Store the keys in both the credentials file and environment variables
D. Use the MFA serial number as the secret access key

Correct answer: B. Give the keys only the permissions needed to make the STS API call

MFA does not require broad initial permissions. The lesson specifically recommends restricting the credentials used to obtain the session token.

WordPress Metadata

Suggested Slug:
aws-cli-mfa-sts-session-tokens

Meta Description:
Learn how to use a virtual MFA device with AWS STS to obtain temporary credentials for AWS CLI commands without relying on long-lived credentials stored in the credentials file.

Tags:
AWS CLI, AWS STS, MFA, IAM, CloudOps, Security, Temporary Credentials, Virtual MFA, Environment Variables, AWS S3

AWS CLI MFA Authentication with AWS STS Session Tokens