jorgebastida / jorgebastida/awslogs
Different Credential timeout problem - MFA needed to refresh
- Dominant language
- Python
- Stars
- 5k
- Forks
- 342
- PR merge metrics
- No merged PRs in 30d
Description
I know a few others have posted issues where they got a message the SSO token had expired - I think this is a slightly different case. This appears to be an issue within botocore, where they don't support refreshing credentials with an MFA token.
UPDATE: I found the issue in botocore - handling MFA refresh has been a requested feature since 2019, so not a high priority for them BUT, in the discussion, a user posted a workaround that you might be able to use within awslogs, easy-peasy (if it works 😄 ) https://github.com/boto/botocore/issues/1805#issuecomment-2018335037
I don't know what the odds are of botocore fixing this soon are like, but I was wondering if there's any way that you could catch this exception and maybe print out the information required to resume? I don't know if this is feasible, but, for example, if logs are retrieved in chronological order, then maybe you could track the timestamp of the last log, and display that, so the user can restart with `--since ` or similar
In case it helps, here's the trace:
```
You've found a bug! Please, raise an issue attaching the following traceback
https://github.com/jorgebastida/awslogs/issues/new
Version: 0.15.0
Python: 3.10.12 (main, Aug 15 2025, 14:32:43) [GCC 11.4.0]
boto3 version: 1.26.153
Platform: Linux-6.8.0-83-generic-x86_64-with-glibc2.35
Args: ['/home/jvm/.local/bin/awslogs', 'get', '/backend/prod-1/maverick', '--start=2025-09-24', '--end=2025-09-25', 'ALL']
Config: {options}
Traceback (most recent call last):
File "/home/jvm/.local/lib/python3.10/site-packages/awslogs/bin.py", line 210, in main
getattr(logs, options.func)()
File "/home/jvm/.local/lib/python3.10/site-packages/awslogs/core.py", line 219, in list_logs
consumer()
File "/home/jvm/.local/lib/python3.10/site-packages/awslogs/core.py", line 172, in consumer
for event in generator():
File "/home/jvm/.local/lib/python3.10/site-packages/awslogs/core.py", line 159, in generator
response = self.client.filter_log_events(**kwargs)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/client.py", line 530, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/client.py", line 947, in _make_api_call
http, parsed_response = self._make_request(
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/client.py", line 970, in _make_request
return self._endpoint.make_request(operation_model, request_dict)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/endpoint.py", line 119, in make_request
return self._send_request(request_dict, operation_model)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/endpoint.py", line 198, in _send_request
request = self.create_request(request_dict, operation_model)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/endpoint.py", line 134, in create_request
self._event_emitter.emit(
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/hooks.py", line 412, in emit
return self._emitter.emit(aliased_event_name, **kwargs)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/hooks.py", line 256, in emit
return self._emit(event_name, kwargs)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/hooks.py", line 239, in _emit
response = handler(**kwargs)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/signers.py", line 105, in handler
return self.sign(operation_name, request)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/signers.py", line 180, in sign
auth = self.get_auth_instance(**kwargs)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/signers.py", line 284, in get_auth_instance
frozen_credentials = self._credentials.get_frozen_credentials()
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/credentials.py", line 610, in get_frozen_credentials
self._refresh()
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/credentials.py", line 498, in _refresh
self._protected_refresh(is_mandatory=is_mandatory_refresh)
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/credentials.py", line 514, in _protected_refresh
metadata = self._refresh_using()
File "/home/jvm/.local/lib/python3.10/site-packages/botocore/credentials.py", line 294, in __call__
raise RefreshWithMFAUnsupportedError()
botocore.exceptions.RefreshWithMFAUnsupportedError: Cannot refresh credentials: MFA token required.
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.