Dvc: s3 remote: DVC asks MFA code for each file on push/pull

Created on 14 Nov 2019 · 11Comments · Source: iterative/dvc

Context:

https://discordapp.com/channels/485586884165107732/485596304961962003/644313703038189568

Might be related:

https://github.com/boto/boto3/issues/1179

bug p2-medium research

Source

shcheklein

Most helpful comment

To get the above workaround working, I had to remove the mfa_serial = ... line from the profile I was using in ~/.aws/config

TimothyHyndman on 14 Nov 2019

👍2

All 11 comments

Temporary workaround:

https://discordapp.com/channels/485586884165107732/485596304961962003/644334026311598124

shcheklein on 14 Nov 2019

To get the above workaround working, I had to remove the mfa_serial = ... line from the profile I was using in ~/.aws/config

TimothyHyndman on 14 Nov 2019

👍2

Might be solved by caching the session https://github.com/iterative/dvc/issues/2473#issuecomment-554191280 , but need to confirm.

efiop on 15 Nov 2019

Looked it up. This probably won't be solved by threadsafe caching s3 prop. I am surprised MFA work with dvc at all though.

Need to ask the user how MFA device is set.

Suor on 26 Nov 2019

👍1

Another user is experiencing this same issue. https://discordapp.com/channels/485586884165107732/485596304961962003/656143281163599885

efiop on 16 Dec 2019

We could solve it the same way we do it with passphrase-s for ssh, by using ask_password config option, but maybe we could auto-detect this somehow. Need to research this.

efiop on 16 Dec 2019

From https://docs.aws.amazon.com/cli/latest/topic/config-vars.html

If you specify an mfa_serial, then the first time an AssumeRole call is made, you will be prompted to enter the MFA code. Subsequent commands will use the cached temporary credentials. However, when the temporary credentials expire, you will be re-prompted for another MFA code.

need to take a closer look.

efiop on 16 Dec 2019