Access denied when using aws cli but allowed in web console

Question

My IAM account has "admin" privilege, at least supposedly. I can perform all operations as far as I can tell in web console. For example,

Recently I downloaded aws-cli and quickly configured it by supplying access keys, default region and output format. I then tried to issue some commands and found most of them, but not all, have permission issues. For example

$ aws --version
aws-cli/1.16.243 Python/3.7.4 Windows/10 botocore/1.12.233
$ aws s3 ls s3://test-bucket

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied
$ aws ec2 describe-instances

An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
$ aws iam get-user
{
    "User": {
        "Path": "/",
        "UserName": "[email protected]",
        "UserId": "xxxxx",
        "Arn": "arn:aws:iam::nnnnnnnnnn:user/[email protected]",
        "CreateDate": "2019-08-21T17:09:25Z",
        "PasswordLastUsed": "2019-09-21T16:11:34Z"
    }
}

It appears to me that cli, which is authenticated using access key, has a different permission set from web console, which is authenticated using MFA.

Why is permission inconsistent between CLI and GUI? How to make it consistent?

Answer 1

It turns out following statement in one of my policies blocked CLI access due to lacking MFA.

{
      "Condition": {
        "BoolIfExists": {
          "aws:MultiFactorAuthPresent": "false"
        }
      },
      "Resource": "*",
      "Effect": "Deny",
      "NotAction": [
        "iam:CreateVirtualMFADevice",
        "iam:EnableMFADevice",
        "iam:GetUser",
        "iam:ListMFADevices",
        "iam:ListVirtualMFADevices",
        "iam:ResyncMFADevice",
        "sts:GetSessionToken"
      ],
      "Sid": "DenyAllExceptListedIfNoMFA"
},

Answer 2

If you replace BoolIfExists with Bool, it should work. Your CLI requests would not be denied because of not using MFA.

Opposite of https://aws.amazon.com/premiumsupport/knowledge-center/mfa-iam-user-aws-cli/

Answer 3

I had this same issue and I fixed it by adding my user to a new group with administrator access in IAM.

to do this go to IAM, Users, click on your user and then [add permissions] in the next screen click [Create group] and then pick administrator access

Answer 4

To remain really secure check this good explanation: MFA token for AWS CLI

In few steps

1. Get a temporary 36 hours session token.

aws sts get-session-token --serial-number arn:aws:iam::123456789012:mfa/user --token-code code-from-token

{
    "Credentials": {
        "SecretAccessKey": "secret-access-key",
        "SessionToken": "temporary-session-token",
        "Expiration": "expiration-date-time",
        "AccessKeyId": "access-key-id"
    }
}

2. Save these values in a mfa profile configuration.

    [mfa]
        aws_access_key_id = example-access-key-as-in-returned-output
        aws_secret_access_key = example-secret-access-key-as-in-returned-output
        aws_session_token = example-session-Token-as-in-returned-output

3. Call with the profile

aws --profile mfa

Ps: Don't do the cron job as suggested, it goes again the security.