title: Boto3 STS AssumeRole with MFA Working Example
body: <p>What am I doing wrong here?   I'm able to assume the roles via aws cli as well as boto if I use:</p>
  
  <pre><code>boto3.setup_default_session(profile_name="ROLE_TO_ASSUME")
  </code></pre>
  
  <p>What I'm trying to do: I have a number of AWS accounts my script needs to run in.  I'm tired of typing my mfa each time I need to run the script on a different profile/role.   </p>
  
  <p>I get this error message with the code below:</p>
  
  <pre><code> User: arn:aws:iam::&lt;management account&gt;:user/Ops/&lt;my user&gt; is not authorized to perform: sts:AssumeRole on resource
  </code></pre>
  
  <p>Our AWS is setup like this:
  I am a user, part of a group on a management account. The group has a trust relationship set up with the ROLE_TO_ASSUME role on each account.</p>
  
  <p>Here's my python:</p>
  
  <pre><code>import boto3
  
  def main():
      boto3.setup_default_session(profile_name="default")
      ec2 = boto3.client('ec2')
      get_assumerole_credentials('arn:aws:iam::&lt;REPLACE WITH ACCOUNTID&gt;:role/ROLE_TO_ASSUME')
  
  def get_assumerole_credentials(arn):
      sts_client = boto3.client('sts')
      # Use client object and pass the role ARN
      assumedRoleObject = sts_client.assume_role(RoleArn=arn,
  
  RoleSessionName="AssumeRoleCredstashSession1")
      credentials = assumedRoleObject['Credentials']
      return dict(aws_access_key_id=credentials['AccessKeyId'],
              aws_secret_access_key=credentials['SecretAccessKey'],
              aws_session_token=credentials['SessionToken'])
  
  if __name__ == "__main__":
      main()
  </code></pre>
  
  <p>Here's my ~/.aws/config</p>
  
  <pre><code>[profile default]
  region = us-west-2
  output = json
  aws_access_key_id=&lt;censored&gt;
  aws_secret_access_key=&lt;censored&gt;
  
  [profile ROLE_TO_ASSUME]
  region = us-west-2
  source_profile = default
  role_arn = arn:aws:iam::&lt;accountid&gt;:role/ROLE_TO_ASSUME
  mfa_serial = arn:aws:iam::&lt;accountid&gt;:mfa/&lt;my_user&gt;
  </code></pre>
  
  <p>EDIT based on first reply:<br>
  To be clear, I am able to assume a role if I specify the 'profile' argument as in the following example:</p>
  
  <pre><code>boto3.setup_default_session(profile_name='ROLE_TO_ASSUME')
  ec2 = boto3.resource('ec2', region_name='us-west-1')
  </code></pre>
  
  <p>But I need to assume a role and within the script using boto3's STS to get temp credentials.<br>
  I've noticed there is no MFA prompt when I use the boto3 STS assume role method of connecting.</p>