{"action":"created","issue":{"url":"https://api.github.com/repos/sparkleformation/sfn/issues/121","repository_url":"https://api.github.com/repos/sparkleformation/sfn","labels_url":"https://api.github.com/repos/sparkleformation/sfn/issues/121/labels{/name}","comments_url":"https://api.github.com/repos/sparkleformation/sfn/issues/121/comments","events_url":"https://api.github.com/repos/sparkleformation/sfn/issues/121/events","html_url":"https://github.com/sparkleformation/sfn/issues/121","id":133950098,"number":121,"title":"Possible issue using MFA with role","user":{"login":"jimcroft","id":109199,"avatar_url":"https://avatars.githubusercontent.com/u/109199?v=3","gravatar_id":"","url":"https://api.github.com/users/jimcroft","html_url":"https://github.com/jimcroft","followers_url":"https://api.github.com/users/jimcroft/followers","following_url":"https://api.github.com/users/jimcroft/following{/other_user}","gists_url":"https://api.github.com/users/jimcroft/gists{/gist_id}","starred_url":"https://api.github.com/users/jimcroft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimcroft/subscriptions","organizations_url":"https://api.github.com/users/jimcroft/orgs","repos_url":"https://api.github.com/users/jimcroft/repos","events_url":"https://api.github.com/users/jimcroft/events{/privacy}","received_events_url":"https://api.github.com/users/jimcroft/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2016-02-16T11:03:29Z","updated_at":"2016-02-22T18:50:20Z","closed_at":"2016-02-22T18:50:20Z","body":"This could be an error on my part but here's the issue I'm having.\r\n\r\nAll our engineers have low privilege IAM accounts (MFA not required) and can assume various elevated privilege roles as needed (those roles require MFA).\r\n\r\nUsing the aws-mfa wrapper script works ok for our base users. So I can do the following:\r\n\r\n```\r\naws-mfa\r\neval $(aws-mfa)\r\nbundle exec sfn list\r\n```\r\n\r\n... and get the stack list. When I try to do something with the elevated privilege role:\r\n\r\n```\r\n$ AWS_STS_ROLE_ARN=arn:aws:iam::XXXXXXXXXXXX:role/ElevatedUserRole bundle exec sfn destroy ATestStack\r\n[ERROR]: Failed to create remote API connection. Please validate configuration!\r\nERROR: Miasma::Error::ApiError::RequestError: Forbidden - InvalidClientTokenId: The security token included in the request is invalid.\r\n```\r\n\r\nMy .sfn file contains:\r\n\r\n```\r\n    aws_access_key_id ENV['AWS_ACCESS_KEY_ID']\r\n    aws_secret_access_key ENV['AWS_SECRET_ACCESS_KEY']\r\n    aws_sts_token ENV['AWS_SECURITY_TOKEN']\r\n    aws_sts_role_arn ENV['AWS_STS_ROLE_ARN']\r\n    aws_region ENV['AWS_REGION']\r\n```\r\n\r\nAny ideas? The security token should be valid as it's used in the first example when listing stacks. It just seems not to work when using those STS creds and then trying to assume a role.\r\n"},"comment":{"url":"https://api.github.com/repos/sparkleformation/sfn/issues/comments/187315369","html_url":"https://github.com/sparkleformation/sfn/issues/121#issuecomment-187315369","issue_url":"https://api.github.com/repos/sparkleformation/sfn/issues/121","id":187315369,"user":{"login":"chrisroberts","id":266674,"avatar_url":"https://avatars.githubusercontent.com/u/266674?v=3","gravatar_id":"","url":"https://api.github.com/users/chrisroberts","html_url":"https://github.com/chrisroberts","followers_url":"https://api.github.com/users/chrisroberts/followers","following_url":"https://api.github.com/users/chrisroberts/following{/other_user}","gists_url":"https://api.github.com/users/chrisroberts/gists{/gist_id}","starred_url":"https://api.github.com/users/chrisroberts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrisroberts/subscriptions","organizations_url":"https://api.github.com/users/chrisroberts/orgs","repos_url":"https://api.github.com/users/chrisroberts/repos","events_url":"https://api.github.com/users/chrisroberts/events{/privacy}","received_events_url":"https://api.github.com/users/chrisroberts/received_events","type":"User","site_admin":false},"created_at":"2016-02-22T18:50:20Z","updated_at":"2016-02-22T18:50:20Z","body":"Fix and enhancements in 2.1.2. Thanks for the report!"}}