1

I got this error :

Error executing 'up': AssumeRoleTokenProviderNotSetError: assume role with MFA enabled, but AssumeRoleTokenProvider session option not set.

when trying to execute this command :

ecs-cli up --force --capability-iam --size 2 --instance-type t2.medium --cluster-config [my-config] --aws-profile [my-profile] --port [xxxx] [xx]

With this configuration :

  • .aws/config 
[default]
region = eu-west-1

[profile my-profile]
role_arn = arn:aws:iam::xxxxxxxxxxx:role/xxxxxx
region = eu-west-1
source_profile = default
mfa_serial=arn:aws:iam::xxxxxxxxxx:mfa/xxxxxxxxxxx
  • .aws/credential : they are generated with get-session-token
aws_access_key_id = XXXXXXXXXXXXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXx
aws_session_token = XXXXXXXXXXXXXXXX
  • .ecs/config 
version: v1
default: default
clusters:
  my-config:
    cluster: cluster_name
    region: eu-west-1
    default_launch_type: EC2
  default:
    cluster: default
    region: eu-west-1
    default_launch_type: EC2
  • .ecs/credential
version: v1
default: my-profile
ecs_profiles:
  my-profile:
    aws_access_key_id: XXXXXXXXXXXXXXXXX
    aws_secret_access_key: XXXXXXXXXXXXXXXXXXXXXX

Also tried to use temporary session, but I got the same error. Thanks for help !

Habib C
  • 11
  • 2
  • Somewhere you have to call [get-session-token](https://docs.aws.amazon.com/cli/latest/reference/sts/get-session-token.html) where you can specify the MFA token from your device. I'm sure that `ecs-cli` supports that? – Marcin Jun 08 '20 at 09:47
  • Sorry @Marcin my *.aws/credential* file is not complete.I forgot to write "aws_session_token = XXXXXXXX". I called get-session-token with a MFA token from my device, but it still doesn't work. – Habib C Jun 08 '20 at 10:30
  • get-session-token should give you new access key id, secret key id and token. Did you use them? – Marcin Jun 08 '20 at 10:32
  • @Marcin Yes, I use them. Sorry if my description is not crystal clear – Habib C Jun 08 '20 at 10:41
  • No problem. I just speculate now, but if you manually run `get-session token`, place credentials generated in .aws (or .ecs?) config files, then you don't need `[profile my-profile]`. I think that because you use this profile for ecs-cli, aws requires from you new mfa credentials. – Marcin Jun 08 '20 at 10:48
  • I tried this way but I still got this error @Marcin – Habib C Jun 08 '20 at 19:53

0 Answers0