MFA serial in credentials is being ignored

When I define mfa_serial in the source_profile or in the credentials file, AWS Toolkit would not ask me for a MFA token which causes an “access denied” error.

Here is a config that works because I defined mfa_serial directly in the profile: ~/.aws/config:

[default]
region = eu-central-1

[profile foo]
role_arn = arn:aws:iam::***:role/AdminRole
mfa_serial = arn:aws:iam::***:mfa/foo
source_profile = default

~/.aws/credentials:

[default]
aws_access_key_id = asdf
aws_secret_access_key = asdf

Here is a config that does not work because I defined mfa_serial in the source_profile: ~/.aws/config:

[default]
region = eu-central-1
mfa_serial = arn:aws:iam::***:mfa/foo

[profile foo]
role_arn = arn:aws:iam::***:role/AdminRole
source_profile = default

~/.aws/credentials:

[default]
aws_access_key_id = asdf
aws_secret_access_key = asdf

Here is a config that does not work because I defined mfa_serial in the credentials file: ~/.aws/config:

[default]
region = eu-central-1

[profile foo]
role_arn = arn:aws:iam::***:role/AdminRole
source_profile = default

~/.aws/credentials:

[default]
aws_access_key_id = asdf
aws_secret_access_key = asdf
role_arn = arn:aws:iam::***:role/AdminRole

[justinmk3]

We have not yet merged the fix, so would like to keep this open.

[JadenSimon]

@odbaeu We currently have a PR #1766 that should resolve this issue. MFA serials are now lifted out of source profiles into the child profile for role assumption. I tested one of your non-working configurations and it works correctly for me.

To confirm the fix works for all your potential use cases, it would be helpful you can try out the pre-release build:

1. Download and extract buildArtifacts.zip
2. From the VSCode command list (ctrl-shift-p or cmd-shift-p) run Extensions: Install from VSIX… to install the *.vsix file.
3. Reload VSCode and verify that the Toolkit has version 1.26 (not the release version 1.25).