aws sts get-session-token ... --token-code ... fails with InvalidClientTokenId, but MFA console login working

Question

I am trying to retrieve session token on the AWS CLI like so:

aws sts get-session-token --serial-number arn-string --token-code mfacode

where

• arn-string is copied from the IAM management console, security credentials for the assigned MFA device,format like arn:aws:iam:<number>:mfa/<name>
• mfacode is taken from the registered virtual mfa device

error:

An error occurred (InvalidClientTokenId) when calling the GetSessionToken operation: The security token included in the request is invalid.

However, I use that MFA device to login to the console in the browser just fine

I have only a default profile in my ~/.aws/, but I don't see how this would have any influence.

tried this:

1. try multiple time to ensure no mfa flip-over has happened
2. delete MFA device assignment and reassign device -- same error
3. ommitting --token-code in hope to have it prompt me for the MFA device token -- same error
4. using the arn:aws:iam:<number>:user/<name> -- same error as can be expected since the aws get-session-id help clearly states it needs to be the arn of the mfa device

I figure this has to do with arn-string rather than the token, but what ? Any idea on what causes this problem most welcome.

Regards, Olaf

Answer 1

Solved. maafk's comment nails it down. For the records and to the next poor soul stumbling into this problem:

The profile used must have themfa_serial entry. In my case added the arn-string for the mfa-device to my local default profile in ~/.aws/config like so:

[default]

region = eu-central-1

mfa_serial = arn:aws:iam:<number>:mfa/<name>

This string can be found in the console, IAM service under the user, security credentials.