This would be very helpful. In our AWS account, all of our IAM accounts have MFA required; the only thing that we can do with our base account is to register an MFA, change our password, or retrieve STS tokens using our MFA. I have a script that logs into each of our accounts and generates profile entries with the STS credentials; for example, if I had a credentials file that looked like this:
[devaws]
region = us-east-1
aws_access_key_id = REDACTED1
aws_secret_access_key = REDACTED2
[moxieawsprod]
region = us-east-1
aws_access_key_id = REDACTED3
aws_secret_access_key = REDACTED4
After running the script, it would look like this:
[devaws]
region = us-east-1
aws_access_key_id = REDACTED1
aws_secret_access_key = REDACTED2
[moxieawsprod]
region = us-east-1
aws_access_key_id = REDACTED3
aws_secret_access_key = REDACTED4
[devawsmfa]
region = us-east-1
aws_access_key_id = REDACTED5
aws_secret_access_key = REDACTED6
aws_session_token = REDACTED7
[moxieawsprodmfa]
region = us-east-1
aws_access_key_id = REDACTED8
aws_secret_access_key = REDACTED9
aws_session_token = REDACTED10
It would be great to be able to say "this S3 account should use the profile 'moxieawsprodmfa'".