MFA support like in other AWS SDKs

[JPLachance]

Hello,



We started to use the switch role feature a couple of months ago and we are using the MultiFactorAuthPresent condition, therefore forcing users to be logged in using their MFA and it’s working perfectly.

It’s working in the web console, it’s working with AWS CLI and with many AWS SDKs (like boto3 or the Go SDK) since those SDKs are reading the mfa_serial field in the ~/.aws/credentials file.



I tested the most recent Java SDK for AWS (1.11.213) and it seems like it’s not supported. 

Would it be possible to read the mfa_serial field in the .aws/credentials and then ask the MFA when starting a Java process?



See a related issue in the Go SDK: aws/aws-sdk-go#842

Thanks!

[jkoberg]

This would make writing one-off scripts way way way easier

[moalexmonk]

I got it working like this:

import java.util.Date;
import java.util.Scanner;
import com.amazonaws.services.securitytoken.model.Credentials;
import com.amazonaws.auth.BasicSessionCredentials;
import com.amazonaws.services.securitytoken.model.AssumeRoleRequest;
import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClientBuilder;
import com.amazonaws.auth.AWSCredentials;
import com.amazonaws.auth.profile.internal.securitytoken.STSProfileCredentialsServiceProvider;
import com.amazonaws.auth.profile.ProfileCredentialsProvider;
import com.amazonaws.profile.path.AwsProfileFileLocationProvider;
import com.amazonaws.auth.profile.ProfilesConfigFile;
import com.amazonaws.ClientConfiguration;
import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder;
import com.amazonaws.services.identitymanagement.model.ListRolesRequest;
import com.amazonaws.services.identitymanagement.model.ListRolesResult;
import com.amazonaws.services.identitymanagement.model.Role;

public class TestAWS {
    // MFA stuff
    private static ProfileCredentialsProvider getCredentialsProvider(String profileName, ClientConfiguration clientConfiguration) {
        return new ProfileCredentialsProvider(new ProfilesConfigFile(
            AwsProfileFileLocationProvider.DEFAULT_CREDENTIALS_LOCATION_PROVIDER.getLocation(),
            targetRoleInfo -> new STSProfileCredentialsServiceProvider(targetRoleInfo) {
                private BasicSessionCredentials cache;
                private Date cacheExpiration;
                public AWSCredentials getCredentials() {
                    if (cache != null && new Date().before(cacheExpiration)) {
                        return cache;
                    }
                    // TODO: Is there any way we can integrate this with botocore's session cache at ~/.aws/cli/cache ?
                    String mfaSerial = new ProfilesConfigFile()
                        .getAllBasicProfiles()
                        .get(profileName)
                        .getPropertyValue("mfa_serial");
                    if (mfaSerial == null) {
                        return super.getCredentials();
                    }
                    System.out.print("Enter your MFA code for " + mfaSerial + ": ");
                    String code = new Scanner(System.in).nextLine().trim();
                    // Could also do GetSessionToken and then cache if we were wanting multiple assume roles etc.
                    Credentials credentials = AWSSecurityTokenServiceClientBuilder.standard()
                        .withClientConfiguration(clientConfiguration)
                        .build()
                        .assumeRole(new AssumeRoleRequest()
                            .withRoleArn(targetRoleInfo.getRoleArn())
                            .withRoleSessionName(targetRoleInfo.getRoleSessionName())
                            .withSerialNumber(mfaSerial)
                            .withTokenCode(code)
                            .withDurationSeconds(3600) // TODO: Could increase if we used any roles with a higher max duration - might want to pull this from a profile property like https://github.com/boto/botocore/pull/1431
                        ).getCredentials();
                    cacheExpiration = credentials.getExpiration();
                    cache = new BasicSessionCredentials(
                        credentials.getAccessKeyId(),
                        credentials.getSecretAccessKey(),
                        credentials.getSessionToken()
                    );
                    return cache;
                }
            }
        ), profileName);
    }

    // business logic + proxy setting
    public static void main(String[] args) {
        ClientConfiguration clientConfiguration = new ClientConfiguration()
            .withProxyHost("yourproxyname")
            .withProxyPort(yourproxyport);

        ListRolesResult res = AmazonIdentityManagementClientBuilder.standard()
            .withCredentials(getCredentialsProvider("your-profile-name", clientConfiguration))
            .withRegion("eu-west-1")
            .withClientConfiguration(clientConfiguration)
            .build()
            .listRoles(new ListRolesRequest());
        for (Role role : res.getRoles()) {
            System.out.println(role.getRoleName());
        }
    }
}

(obviously you can loose the proxy stuff if your local network doesn't require it)

[rberger]

How can this not be a top priority to have MFA support for the Java SDK? Having CLI tools that don't use MFA is such a huge security hole!

[nickbas]

So what moalexmonk wrote is required because AWS JAVA SDK does not do this for us automatically?

[millems]

Unfortunately we won't be supporting this in 1.11.x of the SDK, because we're concentrating our effort in 2.x of the SDK.

See StsAssumeRoleCredentialsProvider, StsAssumeRoleWithWebIdentityCredentialsProvider or StsAssumeRoleWithSamlCredentialsProvider for 2.x for a way to provide a callback to supply new information when a role needs to be refreshed.

We still don't support getting mfa_serial from the credentials/config file, so if this is something you need can you create a new feature request in the V2 repository?

[JPLachance]

Hello @millems,

I can spend time to open an issue in the V2 repository, but I think someone from AWS should take the ownership of this feature.

In Python, with boto3, we don't have to add any line of code and when the mfa_serial field is present in the in the ~/.aws/credentials file, it ask us our MFA code. It's super user friendly.

In my opinion, AWS SDKs should all implement the same features. If it is supported in Python, why not Java? 😄

I'll let you guys debate on this one.

Regards,
Jean-Philippe Lachance

[millems]

@JPLachance That's reasonable.

The hard part is that it's easy to do in the CLI: If there's a mfa_serial, prompt the user for more information. In an SDK, how do we "prompt the user"? The majority of the Java SDKs customers aren't writing a CLI... they're writing a service that has no one to "prompt".

We could add some configuration (mfa_serial_prompt = std_in?) on how to "prompt" the user, but that adds a new requirement which needs coordination and agreement across all of the SDKs. It's not unsolvable, but it's not a trivial change, either.

[JPLachance]

Hello @millems,

I'm looking at botocore's source code and here is what they did:

    def _assume_role_kwargs(self):
        """Get the arguments for assume role based on current configuration."""
        assume_role_kwargs = deepcopy(self._assume_kwargs)

        mfa_serial = assume_role_kwargs.get('SerialNumber')

        if mfa_serial is not None:
            prompt = 'Enter MFA code for %s: ' % mfa_serial
            token_code = self._mfa_prompter(prompt)
            assume_role_kwargs['TokenCode'] = token_code

        duration_seconds = assume_role_kwargs.get('DurationSeconds')

        if duration_seconds is not None:
            assume_role_kwargs['DurationSeconds'] = duration_seconds

        return assume_role_kwargs

They built the AssumeRoleCredentialFetcher class. That class is called when an assume role configuration is found in the .aws/credentials file. In that class, they get the assume role kwargs based on what was defined in the user configuration file. They prompt for the MFA in boto3 when the find the mfa_serial field in the config file.

It makes sense to me and it won't happen on a production server, because on the production server, boto3 will use credentials in environment variables, or use the AWS metadata API or use the assume role with web identity feature, etc.

In boto3, they assumed users won't use an assume role configuration with the mfa_serial field set on their production server. An .aws/credentials file is not required in AWS.

Java can be used to build CLI tools. At least two users expressed they would like the support for the mfa_serial field in this thread 🙂

I don't deny that the majority of Java SDKs customers are not writing CLIs, but some are and since it is supported in other SKDs, since AWS is promoting the use a single IAM identity with multiple IAM roles, I think it make sense to implement that prompt.

I'll let you decide if it is worth the time to re-open this feature request, or open a new one in the V2 repository.

Regards,
Jean-Philippe Lachance

[millems]

@JPLachance It definitely has some value for CLI applications, and other use-facing things like IDEs or other tools that use the Java SDK. That's why I think it makes sense as a V2 feature request. Unfortunately we won't be doing it in V1.