get_session_example.py

def get_session(target_profile, mfa_arn, token_code=None, region='us-east-1'):
  import re, sys
  from os.path import expanduser

  temp_profile = 'tmp_{}_boto3'.format(target_profile)
  
  creds = {}
  resp_key_map = {
    'AccessKeyId' : 'aws_access_key_id',
    'SecretAccessKey' : 'aws_secret_access_key',
    'SessionToken' : 'aws_session_token'
  }

  p = re.compile('^\[.*\]$')
  profile = None

  with open(expanduser('~/.aws/credentials'), 'r') as f:
    for l in f:
      l = l.strip()
      if p.match(l):
        profile = l[1:-1]
        creds[profile] = {}
      elif len(l) > 0:
        k,v = l.split('=')
        creds[profile][k.strip()] = v.strip()

  temp = creds.get(temp_profile, None)
  if temp:
    try:
      session = boto3.Session(
        aws_access_key_id = temp['aws_access_key_id'],
        aws_secret_access_key = temp['aws_secret_access_key'],
        aws_session_token = temp['aws_session_token'],
        region_name = region
      )
      sts = session.client('sts')
      sts.get_caller_identity()
      return session
    except ClientError as e:
      print('STS token invalid -- requesting a new one. ')
      
  if not token_code:
    token_code = input('Enter MFA token code: ')

  session = boto3.Session(profile_name=target_profile, region_name=region)
  sts = session.client('sts')

  try:
    resp = sts.get_session_token(
      SerialNumber = mfa_arn,
      TokenCode = token_code
    )
  except ClientError as e:
    print('Error requesting session token')
    print('  {}: {}'.format(e.response['Error']['Code'], e.response['Error']['Message']))
    sys.exit(2)

  token = resp['Credentials']
  creds[temp_profile] = {}
  for k,v in token.items():
    if k in resp_key_map.keys():
      creds[temp_profile][resp_key_map[k]] = v

  with open(expanduser('~/.aws/credentials'), 'w') as f:
    for profile, access_keys in creds.items():
      f.write('[{}]\n'.format(profile))
      [f.write('{}={}\n'.format(k,v)) for k,v in access_keys.items()]
      f.write('\n')

  return boto3.Session(
    aws_access_key_id = token['AccessKeyId'],
    aws_secret_access_key = token['SecretAccessKey'],
    aws_session_token = token['SessionToken'],
    region_name = region
  )

if __name__ == '__main__:
  mfa_arn = 'arn:aws:iam::962425701280:mfa/jonn@nvisium.com'
  target_profile = 'eng'

  session = get_session(target_profile, mfa_arn)
  ec2 = session.client('ec2')

discrete little func that you can import into one-time boto3 scripts when you need to hit mfa-locked envs. leverages ~/.aws/credentials profiles for storing STS tokens.