aws / aws/aws-extensions-for-dotnet-cli
Cannot use dotnet lambda with MFA enabled
- Dominant language
- C#
- Stars
- 393
- Forks
- 90
- Avg merge
- 2d 19m
- Merged PRs (30d)
- 3
Description
### Describe the bug
I have MFA enabled and required for my IAM user and assumable IAM role, and the appropriate config/credentials file for AWS CLI. I can successfully use the AWS CLI and the SAM CLI (meaning I am prompted for an MFA code and the commands succeed), but the `Amazon.Lambda.Tools` CLI commands fail to execute and do not even prompt me for an MFA token.
### Expected Behavior
`dotnet lambda xxx` should prompt for the MFA token and successfully execute.
### Current Behavior
`dotnet lambda xxx` does not prompt for the MFA token and fails with the following error:
```
Amazon Lambda Tools for .NET Core applications (5.4.5)
Project Home: https://github.com/aws/aws-extensions-for-dotnet-cli, https://github.com/aws/aws-lambda-dotnet
: Unable to get IAM security credentials from EC2 Instance Metadata Service.
```
### Reproduction Steps
AWS credentials file:
```
[default]
aws_access_key_id =
aws_secret_access_key =
```
AWS config file:
```
[default]
region = eu-west-3
output = json
role_arn = arn:aws:iam:::role/
source_profile = default
mfa_serial = arn:aws:iam:::mfa/
```
IAM role permissions:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
```
IAM role trust relationships:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam:::root"
},
"Action": "sts:AssumeRole",
"Condition": {
"Bool": {
"aws:multifactorAuthPresent": "true"
}
}
}
]
}
```
Failing command:
Any `dotnet lambda` command involving an API call to AWS, such as:
```
dotnet lambda invoke-function
```
### Targeted .NET platform
.NET 6
### CLI extension version
amazon.lambda.tools 5.4.5 dotnet-lambda
### Environment details (OS name and version, etc.)
Windows 11
Contributor guide
Research direction
Start by reproducing `dotnet lambda invoke-function ` on Windows 11 with the shown AWS config and Amazon.Lambda.Tools 5.4.5, then compare its credential handling with the working AWS CLI and SAM CLI flows. Trace the Amazon.Lambda.Tools credential resolution path; done means an API-calling `dotnet lambda` command prompts for the MFA token and succeeds.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, csharp
- Domain
- authentication, cli, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100