title: How do I use AWS STS Assume role with MFA using AWS SDK Go v2?
body: <p>Here is what I am trying to do. I have 2 AWS Accounts A and B. Using AWS SDK for Go v2 I want to use a CLI profile with credentials for Acct A and assume a role in Account B that requires MFA.</p>
  <p>I have read through the package docs for config and stscreds <a href="https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/aws/stscreds" rel="nofollow noreferrer">https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/aws/stscreds</a>. It is so confusing host of issues (compile errors). I tried <a href="https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials@v1.2.0/stscreds" rel="nofollow noreferrer">https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/credentials@v1.2.0/stscreds</a> as well as you see in the code, however the line below errors.</p>
  <pre><code>cfg.Credentials = &amp;aws.CredentialsCache{Provider: creds} 
  </code></pre>
  <p>ERROR: unknown field 'Provider' in struct literal of type aws.CredentialsCache</p>
  <p>Here is what I have so far.</p>
  <pre><code>    package main 
      
      import (
          &quot;context&quot;
          &quot;log&quot;
      
          &quot;github.com/aws/aws-sdk-go-v2/aws&quot;
          &quot;github.com/aws/aws-sdk-go-v2/config&quot;
          &quot;github.com/aws/aws-sdk-go-v2/credentials/stscreds&quot;
          &quot;github.com/aws/aws-sdk-go-v2/service/sts&quot;
      )
      
      func main() {
          region := &quot;us-west-2&quot;
          profile := &quot;acctacliprofile&quot;
          roleToAssume := &quot;arn:aws:iam::accountB:role/TestRole&quot;
          externalID := &quot;TestingOnly&quot;
          mfaSerial := &quot;arn:aws:iam::acctA:mfa/user&quot;
          ctx := context.TODO()
          cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(region), 
          config.WithSharedConfigProfile(profile))
          if err != nil {
            log.Fatal(err)
          }
          creds := stscreds.NewAssumeRoleProvider(sts.NewFromConfig(cfg), roleToAssume, func(o 
          *stscreds.AssumeRoleOptions) {
             o.SerialNumber = aws.String(mfaSerial)
             o.ExternalID = aws.String(externalID)
             o.TokenProvider = stscreds.StdinTokenProvider
          })
          c, err := creds.Retrieve(ctx)
          if err != nil {
           log.Fatal(err)
          }
          log.Printf(&quot;%T\n&quot;, c)
          log.Printf(&quot;%v\n&quot;, c.AccessKeyID)
          log.Printf(&quot;%v\n&quot;, c.SecretAccessKey)
          log.Printf(&quot;%v\n&quot;, c.SessionToken)
  }
  </code></pre>
  <p>This basically works, asks to provide the MFA token and assume role succeeds but how do I use these credentials to create service clients etc since cfg was created with the local cli profile, and I want to use the temporary credentials to make the service calls.</p>
  <p>Since the code below from docs fail, how do I update cfg with the new credentials and make the s3 or other service calls with creds.</p>
  <pre><code>cfg.Credentials = &amp;aws.CredentialsCache{Provider: creds}
  
  // Create service client value configured for credentials
  // from assumed role.
  svc := s3.NewFromConfig(cfg)
  </code></pre>
  <p>Wish the docs for the new AWS Go SDK v2 didn't leave a lot to be desired.</p>
  <p>Thanks for any help.</p>