Aws-vault: windows: MFA prompt doesn't wait for input

[pda]

Reported by a coworker:

C:\Users\example\Downloads>aws-vault-windows-386.exe --debug exec example-read-only
2017/06/06 03:59:43 Parsing config file C:\Users\example\.aws\config
2017/06/06 03:59:43 Looking up keyring for example
Enter passphrase to unlock C:\Users\example\.awsvault\keys:
2017/06/06 03:59:47 Session not found in keyring
Enter token for arn:aws:iam::123456789012:mfa/example: 2017/06/06 03:59:47 Getting new session token for profile example
aws-vault: error: Failed to get credentials: InvalidParameter: 1 validation error(s) found.
- minimum field size of 6, GetSessionTokenInput.TokenCode.

Note that the “Enter token for …” prompt appears, but does not wait for input, instead proceeding with an empty MFA token.

Looking at this code it seems p.MfaPrompt() must be returning a token and no error. I'm confident thatp.MfaPrompt is a reference to prompt.Terminal(). I think text, err := reader.ReadString('\n') is returning "", nil or "\n", nil despite no user input. I was considering looping until a non-empty string was read, but that might be obnoxious (e.g. it'd break “enter blank string for default”). Or, flushing stdin prior to prompting for input, but I don't know if there's a portable way to do that?

I don't have a Windows machine to test this on. Perhaps nobody has ever used aws-vault with MFA in Windows?

Edit: windows \r\n newlines are an obvious suspect, but the ReadString('\n') combined with TrimSpace() should handle that?

[lox]

I don't have a Windows machine to test this on. Perhaps nobody has ever used aws-vault with MFA in Windows?

☝🏻

Looks like there are lots of more portable ways of reading strings in golang: https://stackoverflow.com/questions/20895552/how-to-read-input-from-console-line

[joho]

I've got a windows PC at home and would be happy to try a couple to PR against this.

[williamdenton]

I'm using v4 on windows 10 and MFA works fine when assuming roles

[evolutionise]

Also encountering this issue on Windows 10.

Have attempted to fix by removing all existing credentials, deleting and readding profiles, rotating profiles. I tried using aws-vault from Powershell and from MinGW None of these things made any difference. I got a copy of the binary @williamdenton has been using, and it still doesn't work on my machine. Neither of us know why.

I noticed a similar issue where, immediately after adding a new profile, it would proceed to execute the command without waiting for the passphrase to be entered. The second time I ran the same command, it would wait.

[danbrake]

I am having the same issue on Windows 10 v4.2.0. Is there a fix or workaround? I have tried reentering credentials and reinstalling.

After I enter the passphrase I see the prompt to enter a MFA token and the error message associated with submitting without a MFA token. It does not wait for user input after the following:
Enter token for arn:aws:iam::000000000000:mfa/example

Output:
```C:Usersexample>aws-vault exec dev -- aws ec2 describe-instances
Enter passphrase to unlock C:Usersexample/.awsvault/keys/:
Enter token for arn:aws:iam::000000000000:mfa/example: aws-vault: error: Failed to get credentials for dev: InvalidParameter: 1 validation error(s) found.

• minimum field size of 6, GetSessionTokenInput.TokenCode.
  ```

[danbrake]

Quick note on this... after cloning the repo to have a look at the issue I noticed that you can pass the MFA token in when you run aws-vault by using a "-m" flag. The issue is still there if you try and run without passing the token but it is a workaround for anyone having the same issue.

The following now works for me:

aws-vault exec dev -m 340793 -- aws ec2 describe-instances

[lox]

Sorry folks, I lack the bandwidth to do windows testing on this at present, but would happily collaborate on a PR!

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[biswaranjanb]

Is this issue resolved ?