MFA to Access Wasabi Using AWS CLI

How do I use MFA to authenticate access to Wasabi using AWS CLI?

It is best practice to protect your account and its resources by using a multi-factor authentication (MFA) device. If you plan to interact with your resources using the AWS CLI when using an MFA device, you must create a temporary session. The steps below detail how you can achieve this for any user.

1. Log into Wasabi Management Console and create a user.

In this example, we are creating a user called "mfa-demo" and giving them Programmatic and Console access. You may decide whether or not to give Console access if that is not a requirement. Download the credentials file once the user is created and store it in a secure location, as we will be using these credentials later to configure AWS CLI.

2. Design an IAM policy that will force the user to authenticate with MFA for any action.

3. Open the Policies tab. Create a policy as per your requirements for the user. In this example, we are creating a policy called "policy-for-demo-user".

Actual Policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "s3:*",
"Resource": "*",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
]
}

3. Once the user and policy is created, navigate to that user and attach the newly created policy to them.

4. If not already installed on your system, install the latest version of AWS CLI.

5. Use the credential file that you downloaded while creating a user in Step 1. Execute the command below to configure an MFA user's profile. Be sure to use your own Access Key ID and Secret Key ID.

$ aws configure --profile 

6. In the Console, navigate to your MFA-created user and activate virtual MFA using any of these tested applications.

7. Once the MFA is activated for your user, copy the ARN of this user and store it in a secure location.

8. On the CLI, run the sts get-session-token command. Replace the variables with information from your account, resources, and MFA device.

$ aws sts get-session-token --serial-number  --token-code  --profile  --endpoint-url=https://sts.wasabisys.com

You will receive an output with temporary credentials and an expiration time (default: 12 hours), similar to the following.

{
"Credentials": {
"SecretAccessKey": "secret-access-key",
"SessionToken": "temporary-session-token",
"Expiration": "expiration-date-time",
"AccessKeyId": "access-key-id"
}
}

9. Edit the credentials file in the .aws folder in the home directory of the user to add a new profile configuration for issuing MFA-authenticated commands. Below is an example profile configuration.

   In this example, we are configuring a profile name as "mfa-demo-temporary".

   [mfa-demo-temporary]
   aws_access_key_id = example-access-key-as-in-returned-output
   aws_secret_access_key = example-secret-access-key-as-in-returned-output
   aws_session_token = example-session-Token-as-in-returned-output

   

10. After the credentials expire, execute the get-session-token command again and export the returned values either to the environment variables or to the profile configuration.

    Consider running a script or a cron job in the background that checks for "expiration" from the output of get-session-token command, then prompting for re-authentication.

11. To show the working of this authentication, we have uploaded an object to a Wasabi bucket with regular credentials and temporary sts credentials. Even though this user has complete permission to perform any S3 action, it will get denied due to the forced MFA policy. The operation is only successful when the temporary sts credentials are used, which is governed by MFA.

    

    Note that this code example discusses the use of Wasabi's us-east-2 storage region. To use other Wasabi storage regions, use the appropriate Wasabi service URL as described in Service URLs for Wasabi's Storage Regions.

Appendix

export AWS_ACCESS_KEY_ID=example-access-key-as-in-previous-output
export AWS_SECRET_ACCESS_KEY=example-secret-access-key-as-in-previous-output
export AWS_SESSION_TOKEN=example-session-token-as-in-previous-output

set AWS_ACCESS_KEY_ID=example-access-key-as-in-previous-output
set AWS_SECRET_ACCESS_KEY=example-secret-access-key-as-in-previous-output
set AWS_SESSION_TOKEN=example-session-Token-as-in-previous-output

unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY
unset AWS_SESSION_TOKEN