<p>Indeed, this is a pain. I've been fighting with it for the whole day yesterday, but managed to get it working, let's see if our cases are similar enough.</p>

<p>My guess is that the <em>usual</em> <code>aws configure</code> configuration with a MFA ARN + the AWS SDK used to develop <em>kubectl</em> are not entirely compatible: I have two profiles set for this, one that has its <em>mfa_serial_arn</em> and <em>role_arn</em> that works as follows:</p>

<ul>
<li>First <strong>aws</strong> command I type, I get prompted for MFA token </li>
<li>From there onwards, while session is active, I can work without typing in more tokens.</li>
<li><em>kubectl</em> asks for a token EVERY SINGLE TIME.</li>
</ul>

<p>This is bad.</p>

<p>Now, I set a different profile, without any of the above, and I do the following:</p>

<p>```</p>

<pre><code>keys=($(aws sts assume-role --role-arn &lt;ARN_OF_DELEGATED_ROLE&gt; \
   --role-session-name  &lt;RANDOM_UNIQUE_NAME&gt; \
   --serial-number &lt;ARN_OF_MFA_DEVICE&gt;\
   --token-code  \
    --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text))

# profile used here will be configured in ~/.aws/credentials
export AWS_PROFILE=&lt;PROFILE YOU WANT&gt;

aws configure set aws_access_key_id ${temp_keys[0]}
aws configure set aws_secret_access_key ${temp_keys[1]}
aws configure set aws_session_token ${temp_keys[2]}
</code></pre>

<p>```</p>

<p>This creates a <strong>temporary valid</strong> aws profile, that can be used <strong>BOTH</strong> with the aws cli, and kubectl. </p>

CC BY-SA 4.0
2018-08-01T09:52:58.500Z
Ok, let me try that. I'm not sure if I completely get it, but I'll check and come back to you, if I have questions :) Thanks!
Max N.
CC BY-SA 4.0
2018-08-01T10:37:35.380Z
Hm. Could not get this to work... I execute the above command with a `RANDOM_UNIQUE_NAME` I just made up and a `TOKEN_VALUE` from my MFA device (I just left the `MFA_TOKEN_VALUE` part out. it was just the var used afterwards, right?) and got a block with credentials (`AccessKeyId`, `SecretAccessKey`, `SessionToken`, `Expiration`) and an `AssumedRoleUser` back. `aws configure` lets me just set the access key id and secret. So what do I do with the other info? And what do I do with the session name?
Max N.
CC BY-SA 4.0
2018-08-02T06:34:37.010Z
So, the end result should be a _valid_ block of credentials in the `~/.aws/credentials` file, for the profile you want to use with _kubectl_, let me edit my answer.
mrArias
CC BY-SA 4.0
2018-08-01T07:00:54.873Z
2018-08-02T06:39:21.657Z
2018-08-02T06:39:21.657Z
mrArias
<p>Btw: I managed to fix this problem by using <code>aws-mfa</code> (<a href="https://github.com/broamski/aws-mfa" rel="nofollow noreferrer">https://github.com/broamski/aws-mfa</a>), which I have configured to cache my aws credentials for an hour.</p>

CC BY-SA 4.0
2018-10-11T17:52:20.413Z
2018-10-11T17:52:20.413Z
Max N.
<p>For anyone came here to solve this problem without any workarounds - the solution is simple.</p>
<p>We need to add switch <code>--cache</code> to the kubeconfig for a user used to access a Kubernetes cluster.</p>
<pre><code>users:
- name: &lt;redacted&gt;
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - token
      - --cache
      - -i
      - prod
</code></pre>
<p>Tested on:</p>
<pre><code>$ aws-iam-authenticator version
{&quot;Version&quot;:&quot;v0.5.1&quot;,&quot;Commit&quot;:&quot;d7c0b2e9131faabb2b09dd804a35ee03822f8447&quot;}
</code></pre>
<p>Hope this will help someone.</p>

CC BY-SA 4.0
2020-07-15T09:30:45.030Z
2020-07-15T09:30:45.030Z
Alex
<p>I have set up an EKS cluster in AWS. My user-account there is secured with MFA. And I have an <code>assumerole</code>, that is allowed to manage my infrastructure.</p>

<p>So I installed and configured my system as stated in the AWS userguide: <a href="https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html" rel="noreferrer">https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html</a></p>

<p>I have <code>kubectl</code> in version 1.11.x installed, so I can use that binary to communicate with aws (and I do not need the patched amazon version). I then installed <code>aws-cli</code> and <code>aws-iam-authenticator</code>.</p>

<pre><code>user@notebook [04:44:51 PM] [~]
-&gt; % kubectl version --short --client
Client Version: v1.11.0
user@notebook [04:45:13 PM] [~]
-&gt; % aws-iam-authenticator help
A tool to authenticate to Kubernetes using AWS IAM credentials
...
user@notebook [04:45:25 PM] [~]
-&gt; % aws --version
aws-cli/1.15.51 Python/3.6.6 Linux/4.17.8-1-ARCH botocore/1.10.50
user@notebook [04:45:30 PM] [~]
-&gt; %
</code></pre>

<p>I then created the configuration files from the how-to <code>~/.aws/credentials</code>, <code>~/.aws/config</code>, <code>~/.kube_aws/config</code> and created an alias for myself to use <code>kubectl</code> with the new config (since I have more clusters to manage): <code>alias kubectlaws='KUBECONFIG=/home/user/.kube_aws/config kubectl $@'</code>.</p>

<p>So here comes my problem: When I connect to the cluster using the <code>aws-cli</code> binary, I have to enter my MFA token and then the <em>session</em> is cached (I read for about 15 minutes).</p>

<pre><code>user@notebook [04:58:52 PM] [~]
-&gt; % aws eks describe-cluster --profile my_profile --name ClusterName  --query cluster.status                                                                                          
Enter MFA code for arn:aws:iam::&lt;MY_MFA_ARN&gt;:
"ACTIVE"
user@notebook [04:59:09 PM] [~]
-&gt; % aws eks describe-cluster --profile my_profile --name ClusterName  --query cluster.endpoint                                                                                        
"https://..."
user@notebook [04:59:30 PM] [~]
-&gt; %
</code></pre>

<p>But when I do this with my <code>kubectl</code> alias, I have to enter the token every time I run a command! Furthermore, I cannot re-use a code, so I have to wait about 30 seconds, until the next one is provided.</p>

<pre><code>user@notebook [05:03:56 PM] [~]
-&gt; % kubectlaws get nodes
Assume Role MFA token code: 123456
NAME                             STATUS    ROLES     AGE       VERSION
...
user@notebook [05:04:05 PM] [~]
-&gt; % kubectlaws get nodes
Assume Role MFA token code: 123456
could not get token: AccessDenied: MultiFactorAuthentication failed with invalid MFA one time pass code.                                                                                      
        status code: 403, request id: &lt;SOME_ID&gt;
No resources found.
Unable to connect to the server: getting credentials: exec: exit status 1
user@notebook [05:04:14 PM] [~]
-&gt; %
</code></pre>

<p>This is really annoying, as you might imagine. Has anyone any idea what I did wrong there? Is this a bug? Or is this some kind of mis-configuration?</p>

<p>Thanks in advance!</p>

<amazon-web-services><kubernetes><aws-cli>
Amazon EKS from local kubectl does not cache MFA token/session
Max N.
# Amazon EKS from local kubectl does not cache MFA token/session

(Asked by: username_0 on 2018-07-26)

I have set up an EKS cluster in AWS. My user-account there is secured with MFA. And I have an assumerole, that is allowed to manage my infrastructure.
So I installed and configured my system as stated in the AWS userguide: https://docs.aws.amazon.com/eks/latest/userguide/getting-started.html
I have kubectl in version 1.11.x installed, so I can use that binary to communicate with aws (and I do not need the patched amazon version). I then installed aws-cli and aws-iam-authenticator.
user@notebook [04:44:51 PM] [~]
-> % kubectl version --short --client
Client Version: v1.11.0
user@notebook [04:45:13 PM] [~]
-> % aws-iam-authenticator help
A tool to authenticate to Kubernetes using AWS IAM credentials
...
user@notebook [04:45:25 PM] [~]
-> % aws --version
aws-cli/1.15.51 Python/3.6.6 Linux/4.17.8-1-ARCH botocore/1.10.50
user@notebook [04:45:30 PM] [~]
-> %

I then created the configuration files from the how-to ~/.aws/credentials, ~/.aws/config, ~/.kube_aws/config and created an alias for myself to use kubectl with the new config (since I have more clusters to manage): alias kubectlaws='KUBECONFIG=/home/user/.kube_aws/config kubectl $@'.
So here comes my problem: When I connect to the cluster using the aws-cli binary, I have to enter my MFA token and then the session is cached (I read for about 15 minutes).
user@notebook [04:58:52 PM] [~]
-> % aws eks describe-cluster --profile my_profile --name ClusterName  --query cluster.status                                                                                          
Enter MFA code for arn:aws:iam:::
"ACTIVE"
user@notebook [04:59:09 PM] [~]
-> % aws eks describe-cluster --profile my_profile --name ClusterName  --query cluster.endpoint                                                                                        
"https://..."
user@notebook [04:59:30 PM] [~]
-> %

But when I do this with my kubectl alias, I have to enter the token every time I run a command! Furthermore, I cannot re-use a code, so I have to wait about 30 seconds, until the next one is provided.
user@notebook [05:03:56 PM] [~]
-> % kubectlaws get nodes
Assume Role MFA token code: 123456
NAME                             STATUS    ROLES     AGE       VERSION
...
user@notebook [05:04:05 PM] [~]
-> % kubectlaws get nodes
Assume Role MFA token code: 123456
could not get token: AccessDenied: MultiFactorAuthentication failed with invalid MFA one time pass code.                                                                                      
        status code: 403, request id: 
No resources found.
Unable to connect to the server: getting credentials: exec: exit status 1
user@notebook [05:04:14 PM] [~]
-> %

This is really annoying, as you might imagine. Has anyone any idea what I did wrong there? Is this a bug? Or is this some kind of mis-configuration?
Thanks in advance!

**Tags:** amazon-web-services, kubernetes, aws-cli


---

## 3 answers

### Answer by username_1 on 2018-08-01. Score: 2 | Accepted answer

Indeed, this is a pain. I've been fighting with it for the whole day yesterday, but managed to get it working, let's see if our cases are similar enough.
My guess is that the usual aws configure configuration with a MFA ARN + the AWS SDK used to develop kubectl are not entirely compatible: I have two profiles set for this, one that has its mfa_serial_arn and role_arn that works as follows:

First aws command I type, I get prompted for MFA token 
From there onwards, while session is active, I can work without typing in more tokens.
kubectl asks for a token EVERY SINGLE TIME.

This is bad.
Now, I set a different profile, without any of the above, and I do the following:
```
keys=($(aws sts assume-role --role-arn  \
   --role-session-name   \
   --serial-number \
   --token-code  \
    --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text))

# profile used here will be configured in ~/.aws/credentials
export AWS_PROFILE=

aws configure set aws_access_key_id ${temp_keys[0]}
aws configure set aws_secret_access_key ${temp_keys[1]}
aws configure set aws_session_token ${temp_keys[2]}

```
This creates a temporary valid aws profile, that can be used BOTH with the aws cli, and kubectl.

> **Comments:**
> **username_0**: Ok, let me try that. I'm not sure if I completely get it, but I'll check and come back to you, if I have questions :) Thanks!  
> **username_0**: Hm. Could not get this to work... I execute the above command with a `RANDOM_UNIQUE_NAME` I just made up and a `TOKEN_VALUE` from my MFA device (I just left the `MFA_TOKEN_VALUE` part out. it was just the var used afterwards, right?) and got a block with credentials (`AccessKeyId`, `SecretAccessKey`, `SessionToken`, `Expiration`) and an `AssumedRoleUser` back. `aws configure` lets me just set the access key id and secret. So what do I do with the other info? And what do I do with the session name?  
> **username_1**: So, the end result should be a _valid_ block of credentials in the `~/.aws/credentials` file, for the profile you want to use with _kubectl_, let me edit my answer.  

---

### Answer by username_0 on 2018-10-11. Score: 2

Btw: I managed to fix this problem by using `aws-mfa` (<https://github.com/broamski/aws-mfa>), which I have configured to cache my aws credentials for an hour.


---

### Answer by username_2 on 2020-07-15. Score: 1

For anyone came here to solve this problem without any workarounds - the solution is simple.
We need to add switch --cache to the kubeconfig for a user used to access a Kubernetes cluster.
users:
- name: 
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - token
      - --cache
      - -i
      - prod

Tested on:
$ aws-iam-authenticator version
{"Version":"v0.5.1","Commit":"d7c0b2e9131faabb2b09dd804a35ee03822f8447"}

Hope this will help someone.


---

