Cloudfox throws an AssumeRoleTokenProvider error when I use an assumed IAM role about cloudfox HOT 7 CLOSED

Thanks for reporting this! We used source_profile and assumed roles all the time, and i just confirmed locally it works... but based on the error in your last screenshot I'm thinking that this has to do with the mfa_serial. I'm wondering if this means we're not grabbing everything we need from the AssumeRoleTokenProvider. I'll look into this. Thanks for such a detailed report.

OK yea i think i figured it out. going to push something to seth-dev in a minute

from cloudfox.

@6mile - Can you try it again with the seth-dev branch?

git clone [email protected]:BishopFox/cloudfox.git
git checkout seth-dev 
go build .
./cloudfox aws buckets --profile client-cli-admin

Thanks!

from cloudfox.

Heya @sethsec-bf thanks for jumpin on that! Unfortunately, I'm getting a different error now, and I'm not being prompted for MFA, but I feel like we are getting closer...

@[🦊 cloudfox v1.13.0-prerelease 🦊 ][client-cli-admin] Error retrieving credentials from environment variables, or the instance metadata service.
[🦊 cloudfox v1.13.0-prerelease 🦊 ][client-cli-admin] Could not get caller's identity

Error: operation error STS: GetCallerIdentity, failed to sign request: failed to retrieve credentials: failed to refresh cached credentials, operation error STS: AssumeRole, https response error StatusCode: 400, RequestID: 071a1a4f-04b2-43d9-b678-b88accb36cfa, api error ValidationError: 2 validation errors detected: Value 'theTokenCode' at 'tokenCode' failed to satisfy constraint: Member must have length less than or equal to 6; Value 'theTokenCode' at 'tokenCode' failed to satisfy constraint: Member must satisfy regular expression pattern: [\d]*

from cloudfox.

@6mile - Can you give it another try with the latest code in seth-dev?

I added a new flag --mfa-token that you can use, but you can also just not use that and it should prompt you. feel free to try both and let me know how it works?

from cloudfox.

heya @sethsec-bf that fixed it. Thanks!

from cloudfox.

Closing issue #65

from cloudfox.

I realized that I hadn't tested all scenarios: Not using --mfa-token and supplying the token when I'm prompted; Using the --mfa-token and supplying the MFA token as string on the command line; And finally, with no MFA.
All three appear to work, so will re-close the issue.

from cloudfox.