‫So one question that can come up at the exam is
‫How to use Multi-Factor Authentication
‫with the CLI or with the SDK.
‫So if you want to use it with the CLI
‫you must create a temporary session
‫and to so the API you have to use is
‫STS GetSession Token.
‫So you have to remember it.
‫GetSession Token is the API you want to call
‫to get credentials
‫with a Multi-Factor Authentication device.
‫So we'll do the CLI in a second,
‫which is STS GetSession Token
‫and then we pass the serial number of our our mfa device.
‫The token code from our mfa device
‫and our duration we want for a credentials.
‫This gives us back a result which presents
‫a new Access Key id,
‫Secret Access Key,
‫Session Token that we can all use in API calls to AWS.
‫So let's have a look at the hands-on,
‫it's going to be a lot clearer.
‫So first things first let's go to IAM,
‫and by the way this is a pretty involved hands-on with mfa,
‫you don't have to do it if you don't want to.
‫This is just to demonstrate the API call which is
‫STS GetSession Token.
‫So I'm going to go to my user,
‫find Stephane and then under security credentials
‫I need to assign an mfa device.
‫So I'm going to manage this and I'm going to assign
‫a virtual mfa device,
‫click on continue,
‫and I'm using Authy so I'm going to use Authy application
‫to scan this QR code.
‫So I'm going to show the QR code right now,
‫and then I'm going to add the account,
‫scan it and then I'm going to scan my account.
‫Perfect, this is done.
‫Then I enter again my two mfa codes I am getting from this,
‫so the first one is 902495.
‫The second code I am getting is 865515
‫and then I click on Assign MFA
‫and my device has successfully been registered.
‫So what's important here is to get this Assign MFA device.
‫This arn right here represents what I need to do
‫for the next command.
‫So next I'm going to go into my console,
‫my CLI and I'm going to type
‫aws sts get-session-token
‫and then I need to look at the help
‫because I forgot what's the name of the argument,
‫so it is serial number and token code.
‫So --serial-number
‫and then I paste what I got just from the console
‫-token-code and here I enter the code I get
‫directly from my authenticator or authy app and press enter,
‫and what I get out of it is credentials.
‫Now these credentials are temporary
‫and they're obtained through multi-factor authentication.
‫So I have an AccessKeyId,
‫a SecretAccessKey,
‫a Session Token which is right here all of this,
‫and an Expiration date which is one hour from now.
‫So as we can see this is temporary credentials
‫so I don't mind showing it to you
‫because it's not going to be valid at some point.
‫Okay so now I want to show you how
‫we can use these credentials,
‫so I just regenerated some for this hands-on,
‫so I'm going to copy those
‫into a text file on my other screen.
‫Here we go.
‫And now I'm going to use these credentials.
‫So what I can do is do
‫aws configure --profile mfa.
‫So I'm going to configure a new profile
‫named mfa which corresponds to these credentials
‫I just obtained.
‫So, my AWS Access Key ID is the one I just got
‫from the output so I'm going to paste it here.
‫Then my Secret Access Key,
‫one more time I need to copy it from what I got.
‫Excellent and my Default region name is fine,
‫output format is fine.
‫And next what I have to do is open the file at
‫aws/credentials and so you need to open it using
‫your favorite tool.
‫So for example for me I'm going to us VS code for this
‫and so I opened my file and I need to add the session token.
‫For this I type aws_session_token
‫= and then I copy the entire token that I got from before,
‫so this could be a very, very long token
‫and then I click on save.
‫And now this means that anytime I do an API call
‫using this profile,
‫it's going to use my temporary credentials.
‫So if I go back here and do now
‫aws s3 ls
‫and I do --profile mfa
‫then this is going to issue an API call against
‫Amazon s3 using my profile mfa
‫and you can see a lot of extra buckets
‫because I'm re-recording this lecture right now
‫so you see a lot more extra buckets
‫than what you have right now but don't worry about it.
‫So this is pretty cool because now I've been using
‫the mfa device and I used a session token in here,
‫so this has been temporary credentials
‫and so that's it for this lecture.
‫So it's okay if you couldn't follow it along with me,
‫it's pretty complicated,
‫but the one thing you have to remember is that
‫the API we use to generate these temporary session tokens
‫is called STS GetSession Token
‫and that gave us an Access Key,
‫a Secret Key and a Session Token that was temporary.
‫And that's it and I hope that was helpful
‫and I will see you in the next lecture.