aws / aws/aws-extensions-for-dotnet-cli

Cannot use dotnet lambda with MFA enabled

Open
#240 3 comments 0 reactions 0 assignees View on GitHub
feature-request module/cli-ext p2 queued
Dominant language
C#
Stars
393
Forks
90
Avg merge
2d 19m
Merged PRs (30d)
3

Description

### Describe the bug

I have MFA enabled and required for my IAM user and assumable IAM role, and the appropriate config/credentials file for AWS CLI. I can successfully use the AWS CLI and the SAM CLI (meaning I am prompted for an MFA code and the commands succeed), but the `Amazon.Lambda.Tools` CLI commands fail to execute and do not even prompt me for an MFA token.

### Expected Behavior

`dotnet lambda xxx` should prompt for the MFA token and successfully execute.

### Current Behavior

`dotnet lambda xxx` does not prompt for the MFA token and fails with the following error:

```
Amazon Lambda Tools for .NET Core applications (5.4.5)
Project Home: https://github.com/aws/aws-extensions-for-dotnet-cli, https://github.com/aws/aws-lambda-dotnet

: Unable to get IAM security credentials from EC2 Instance Metadata Service.
```

### Reproduction Steps

AWS credentials file:
```
[default]
aws_access_key_id =
aws_secret_access_key =
```

AWS config file:
```
[default]
region = eu-west-3
output = json
role_arn = arn:aws:iam:::role/
source_profile = default
mfa_serial = arn:aws:iam:::mfa/
```

IAM role permissions:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
```

IAM role trust relationships:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam:::root"
},
"Action": "sts:AssumeRole",
"Condition": {
"Bool": {
"aws:multifactorAuthPresent": "true"
}
}
}
]
}
```

Failing command:

Any `dotnet lambda` command involving an API call to AWS, such as:
```
dotnet lambda invoke-function
```

### Targeted .NET platform

.NET 6

### CLI extension version

amazon.lambda.tools 5.4.5 dotnet-lambda

### Environment details (OS name and version, etc.)

Windows 11

Contributor guide

Open the contributing guide

Research direction

Start by reproducing `dotnet lambda invoke-function ` on Windows 11 with the shown AWS config and Amazon.Lambda.Tools 5.4.5, then compare its credential handling with the working AWS CLI and SAM CLI flows. Trace the Amazon.Lambda.Tools credential resolution path; done means an API-calling `dotnet lambda` command prompts for the MFA token and succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, csharp
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.