Getting Access Denied, and no MFA

[Danno040]

I'm getting the following error when running 0.1.0:

$ ./aws-runas-0.1.0-darwin-amd64 aiprimary
2017/09/25 10:10:46 ERROR error doing AssumeRole: AccessDenied: User: arn:aws:iam::XXXXXXXXXXXX:user/managed-user/mike.feineman@pearson.com is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::XXXXXXXXXXXX:role/managed-role/XXXXXXXXXXXX-PearsonCloudEngineers
    status code: 403, request id: 168d371e-a20c-11e7-abab-abababababab

However, the profile works fine with the AWS cli:

$ aws s3 ls --profile aiprimary
Enter MFA code: 
2017-09-15 14:04:06 <list of s3 buckets>

[mmmorris1975]

can you share the aiprimary and whatever config section the source_profile attribute references, from you .aws/config file?

[Danno040]

It looks like this:

[default]                                                                                                               
output = json                                                                                                           
region = us-east-1
[profile aiprimary]                                                                                                     
role_arn = arn:aws:iam::XXXXXXXXXXXX:user:role/managed-role/XXXXXXXXXXXX:user-PearsonCloudEngineers                               
source_profile = default                                                                                                
mfa_serial = arn:aws:iam::XXXXXXXXXXXX:user:mfa/mike.feineman@pearson.com   

[mmmorris1975]

Thankfully we work together, so I have access to these AWS account :)

The role ARN in that aiprimary profile looks like it should be: arn:aws:iam::XXXXXX:role/managed-role/XXXXXX-PearsonCloudEngineers

See what aws-runas -l gives you as the list of role ARNs you can assume.

[Danno040]

Sorry, the role is arn:aws:iam::XXXXXX:role/managed-role/XXXXXX-PearsonCloudEngineers, there was a copy and paste error with my XXXes.

Like I said, this profile works with the AWS cli.

[mmmorris1975]

Guessing that this is related to the GetSessionToken call that aws-runas does, and your IAM permissions may not allow that. awscli will work because it doesn't call GetSessionToken, but calls AssumeRole directly (which your IAM account has authority for).

Going to add a section to aws-runas README to enumerate the permissions required.

I'll leave this issue open until we can confirm or deny that modifying your IAM account's permissions resolves this

[Danno040]

Just realized I left this open. It was definitely related to IAM account permissions.