Now, keep the terminal window open because we’re going to need it for the next series of steps. The command line tool is installed alongside the GUI version.

YubiKey Manager CLI (ykman) User Manual (click image for link) 1. Let’s start by getting that installed on a macOS (you may need to connect some dots for other systems, but the process is the same).

There’s a CLI version of the YubiKey Manager dubbed ykman that supports our TOTP needs. Oh, but our computer sure does… Let’s see what libraries and tools Yubico has to offer. A YubiKey doesn’t have a watch, or any way to keep time. That’s because AWS will accept that version of OATH and it can be used across the CLI, API, and Console. The solution: We need a way to do OATH-TOTP, which is time based. You can have any OATH you like, so long as it’s HOTP The answer: Only one two-factor authentication is allowed at a time, and the YubiKey Manager program seems to only offer OATH-HOTP, a flavor which AWS will not accept. When I first encountered this problem, I asked myself two questions: “Can I set my key to OTP instead?” and “Can I configure one 2FA for the Console and another for CLI?”. Use AWS API Commands from your terminal.Use AWS CLI Commands via Python libraries.Build Infrastructure as code with Terraform from your machine.What does that mean exactly? If you use a Yubikey for Universal 2nd Factor authentication (U2F) on your AWS Console, you cannot: Join me in my surprise then: By default, it won’t do both. There is one gotcha with an easy workaround: the SDKs don't usually support the login part of the SSO flow, and sometimes don't support it at all (terraform comes to mind).Why Your YubiKey Won’t Work With AWS CLI (and the fix)ĭid you know you can use a YubiKey for 2FA when authenticating in AWS CLI or AWS Console? That sounds fairly obvious and expected. This setup allows you to offload MFA handling to your main IdP with the added bonus of using the same method of authentication, possibly integrated into your OS (for example if using Windows Hello / AzureAD).Īt work, we use Azure AD as the IdP for AWS SSO and it works fairly well, aside from Azure's crappy (inexistent) support of security keys outside of Windows. Otherwise, you'll have to pay for the IdP.

If you already have a compatible one, you can use it at no additional cost. The service itself is free but requires an identity provider. In may not be available in the region you're mostly using but that's not necessarily an issue. You may want to look into AWS Single Sign-On.

Aws u2f