ClientError:An error occurred(AccessDenied)when calling the AssumeRole operation:MultiFactorAuthentication failed with invalid MFA one time pass code

Question

import boto
import boto3
from boto.s3.connection import S3Connection
from boto.sts import STSConnection

# Prompt for MFA time-based one-time password (TOTP)
mfa_TOTP = raw_input("Enter the MFA code: ")
role_arn = "arn:aws:iam::123456789012:role/TestOperator"
client = boto3.client('sts')
response = client.assume_role(RoleArn=role_arn,SerialNumber="arn:aws:iam::760787039612:mfa/C34768",RoleSessionName="test",TokenCode=mfa_TOTP)
print response

While running the above code with valid MFA TokenCode also getting the below error

ClientError: An error occurred (AccessDenied) when calling the AssumeRole operation: MultiFactorAuthentication failed with invalid MFA one time pass code.

Appreciations for help

Answer 1

I resolved the MFA token issue done the below changes in my code

import boto3

role_arn = raw_input("Enter the RoleArn of switch user: ")
SerialNumber = raw_input("Enter the MFA SerialNumber: ")
RoleSessionName = raw_input("Enter the RoleSessionName: ")
mfa_TOTP = raw_input("Enter the MFA code: ")

client = boto3.client('sts')
response = client.assume_role(RoleArn=role_arn,SerialNumber=SerialNumber,RoleSessionName=RoleSessionName,TokenCode=mfa_TOTP)
credentials = response['Credentials']

ec2_resource = boto3.resource('ec2', region,aws_access_key_id = credentials['AccessKeyId'],aws_secret_access_key = credentials['SecretAccessKey'],
                                  aws_session_token = credentials['SessionToken'])
ec2_client = boto3.client('ec2', region,aws_access_key_id = credentials['AccessKeyId'],aws_secret_access_key = credentials['SecretAccessKey'],
                                  aws_session_token = credentials['SessionToken'])

so now we can access the ec2 resource using ec2_resource and ec2_client objects

Thanks...

Answer 2

Unless you put in random account numbers for this post (which is a good idea) then you forgot to put the real account number in your ARN:

role_arn = "arn:aws:iam::123456789012:role/TestOperator"

should be

role_arn = "arn:aws:iam::760787039612:role/TestOperator"