Authenticate AWS CLI with MFA

aws_cli_mfa.sh

function devmfa() {
  ##################################################################################################
  # TODO: fill out these 2 variables
  ##################################################################################################

  # This is the profile with access keys associated with your AWS user account.
  # These keys are useless when MFA is enabled or required for the CLI.
  # However, we can use these keys to call "aws sts get-session-token" along with the MFA code
  # to get a set of temporary credentials and store then in AWS env variables for the CLI to consume.
  # i.e. this profile should be existing in `.aws/credentials`
  aws_profile='<replace-with-profile>'

  # The mfa arn can be found under your user profile in AWS IAM console under "My security credentials"
  # e.g. arn:aws:iam::xxxxxxxxx:mfa/username
  mfa_arn='<replace-with-arn-of-the-mfa-device>'

  if [ -z "$1" ]
  then
    echo "Usage: devmfa <mfa-code>"
  else
    # make sure to unset any existing AWS env vars
    unset AWS_ACCESS_KEY_ID
    unset AWS_SECRET_ACCESS_KEY
    unset AWS_SESSION_TOKEN
    
    # default profile used by aws cli
    export AWS_PROFILE=$aws_profile

    # default aws region required by many resources
    export AWS_DEFAULT_REGION=us-west-2
    
    # fetch the temporary credentials
    # token-code is what you get from your MFA (virtual device) like Google/Microsoft Authenticator
    session=$(aws sts get-session-token --serial-number $mfa_arn --token-code $1)

    # export the AWS env variables with the temporary credentials
    export AWS_ACCESS_KEY_ID=$(echo $session | jq -r .Credentials.AccessKeyId)
    export AWS_SECRET_ACCESS_KEY=$(echo $session | jq -r .Credentials.SecretAccessKey)
    export AWS_SESSION_TOKEN=$(echo $session | jq -r .Credentials.SessionToken)
    
    # unset the default profile so it doesn't override the env variables we just set
    unset AWS_PROFILE
  fi
}

1. Download https://stedolan.github.io/jq/download/ so we can use it to parse the JSON output from the aws commands.

2. Add that function to your .bash_profile or wherever depending on your platform and set <replace-with-profile> and <replace-with-arn-of-the-mfa-device> with your own account values. Make sure to refresh it:
   $ source ~/.bash_profile

3. Run the function on your command line and pass in the MFA code you see in your Google/Microsoft Authenticator:
   $ devmfa 961883

That's it! If no errors, your AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN should be set to the temporary AWS credentials for you to use the CLI normally.
Test it by running a command to list all the S3 buckets in your account:
$ aws s3 ls

Note: The temporary credentials last 12 hours by default so when they expire just run step #3 again to get new credentials .
Check out this link to extend the expiration up to 36 hours as needed:
https://aws.amazon.com/premiumsupport/knowledge-center/authenticate-mfa-cli/