{"action":"reopened","issue":{"url":"https://api.github.com/repos/serverless/serverless/issues/1110","repository_url":"https://api.github.com/repos/serverless/serverless","labels_url":"https://api.github.com/repos/serverless/serverless/issues/1110/labels{/name}","comments_url":"https://api.github.com/repos/serverless/serverless/issues/1110/comments","events_url":"https://api.github.com/repos/serverless/serverless/issues/1110/events","html_url":"https://github.com/serverless/serverless/issues/1110","id":154618164,"number":1110,"title":"Cache credentials and add support for MFA usage with STS assume role","user":{"login":"jonknapp","id":8836231,"avatar_url":"https://avatars.githubusercontent.com/u/8836231?v=3","gravatar_id":"","url":"https://api.github.com/users/jonknapp","html_url":"https://github.com/jonknapp","followers_url":"https://api.github.com/users/jonknapp/followers","following_url":"https://api.github.com/users/jonknapp/following{/other_user}","gists_url":"https://api.github.com/users/jonknapp/gists{/gist_id}","starred_url":"https://api.github.com/users/jonknapp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonknapp/subscriptions","organizations_url":"https://api.github.com/users/jonknapp/orgs","repos_url":"https://api.github.com/users/jonknapp/repos","events_url":"https://api.github.com/users/jonknapp/events{/privacy}","received_events_url":"https://api.github.com/users/jonknapp/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/serverless/serverless/labels/help-wanted","name":"help-wanted","color":"0e8a16"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/serverless/serverless/milestones/8","html_url":"https://github.com/serverless/serverless/milestones/v1.0-ideas","labels_url":"https://api.github.com/repos/serverless/serverless/milestones/8/labels","id":1761859,"number":8,"title":"v1.0-ideas","description":"All tasks which needs to be done in order to release v1.","creator":{"login":"flomotlik","id":132653,"avatar_url":"https://avatars.githubusercontent.com/u/132653?v=3","gravatar_id":"","url":"https://api.github.com/users/flomotlik","html_url":"https://github.com/flomotlik","followers_url":"https://api.github.com/users/flomotlik/followers","following_url":"https://api.github.com/users/flomotlik/following{/other_user}","gists_url":"https://api.github.com/users/flomotlik/gists{/gist_id}","starred_url":"https://api.github.com/users/flomotlik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flomotlik/subscriptions","organizations_url":"https://api.github.com/users/flomotlik/orgs","repos_url":"https://api.github.com/users/flomotlik/repos","events_url":"https://api.github.com/users/flomotlik/events{/privacy}","received_events_url":"https://api.github.com/users/flomotlik/received_events","type":"User","site_admin":false},"open_issues":50,"closed_issues":322,"state":"open","created_at":"2016-05-12T08:39:40Z","updated_at":"2016-10-13T15:19:58Z","due_on":null,"closed_at":null},"comments":10,"created_at":"2016-05-13T01:58:50Z","updated_at":"2016-10-13T15:19:59Z","closed_at":null,"body":"I wanted to start a conversation around how we could support multi-factor authentication when using STS `assumeRole` for AWS calls. I have put together a simple example to show how it could integrate with the current codebase, but it has a few downsides. The code is in a [pull request](https://github.com/CoffeeAndCode/serverless/pull/1) on my fork that I will gladly bring over if desired.\r\n\r\n- I am caching AWS credentials as multiple calls with the same MFA token will fail.\r\n- I need to pass the MFA token in an environment variable since the application does not have the code to pull from stdin if a code is required.\r\n- There are a lot of calls to `getRoleCredentials` that are made for deploying a single function (as there are many parts to a simple function deploy). I'm not sure how caching credentials negatively impacts the codebase.\r\n\r\nIn a perfect world, we would request the MFA on stdin when we see that the aws profile is using a role with MFA or an access request fails with an invalid MFA code, but I'm sure someone here would be able to help that happen faster than I could right now.\r\n\r\nThere are no tests in this pull request at this point.\r\n\r\nTo use, you would make your normal `serverless` cli calls but have the environment variable `AWS_MFA_TOKEN` set to the current timed code. Since the credentials are cached, we only need it to be the current code when the first call is made.\r\n\r\n`AWS_MFA_TOKEN=123456 serverless dash deploy`"}}
{"actor":{"display_login":"flomotlik"}}