3 ms·

Exactly, no workflow for terraform or CLI if you have U2F (Yubikey) 2FA.

• Hnrobert42 6y ago
  I really want to like U2F, but it’s use cases seem so limited.
• darkr 6y ago
  If you use federated auth, then you can do whatever you want; 10 UDF keys and a video of a special dance if you so desire
• BillinghamJ 6y ago
  That's not true. You can use AWS SSO with the CLI/SDKs (therefore including stuff like Terraform) with webauthn. It briefly pops you out to a browser to authenticate and caches a short lived token locally
• nijave 6y ago
  There's AssumeRoleWithSAML so you can use any IdP There's tools like aws-okta that can advantage of that to supply short lived credentials which require 2FA You could also write a service that requires whatever authentication you want and returns the results of STS AssumeRole