I'm using Terraform with the terraform-provider-aws provider to manage my AWS infrastructure. I'm trying to enable mfa_delete on an S3 bucket, but when I try to apply the change I get this error:

1 error occurred:
        * aws_s3_bucket.logs: 1 error occurred:
        * aws_s3_bucket.logs: Error putting S3 versioning: AccessDenied: Mfa Authentication must be used for this request
        status code: 403, request id: <redacted>, host id: <redacted>

How can I run Terraform in a mode that uses multi-factor authentication? My IAM account has a Virtual MFA device attached, but that MFA isn't used when I'm terraforming because terraform uses the API Access Key associated with my account.


The solution is to specify an assume_role statement:

provider "aws" {
  profile = "default"
  assume_role {
    role_arn = "arn:aws:iam::[ACCOUNT_ID]:role/terraform-test-role"
  • I'm already using assume_role so I guess there's some additional detail I'm missing. – Nic Apr 23 '20 at 14:39
  • how does this add a x-amz-mfa to the request? Which is what OP needs – krystan honour Jan 20 at 11:55

I was looking into a similar use case and found this github issue in the terraform public repo: https://github.com/terraform-providers/terraform-provider-aws/issues/629

As quoted in that issue: "Indeed it does seem like the Terraform AWS provider would need to do something special to make this work. As I noted in my other comment, we don't consider Terraform to be an interactive tool in general and so introducing extra interactive input in the apply phase is not ideal."


  • terraform doesn't support mfa tokens. as mentioned here. – krystan honour Jan 20 at 11:55

Assuming that

  • your IAM user can generate an mfa session token via GetSessionToken, and
  • you have a way of getting this token and applying it in your ~/.aws/credentials file (this can be done using helper scripts, like https://github.com/broamski/aws-mfa)

you don't need to specify anything special in the terraform configuration. You just need to make sure your aws cli profile is configured correctly as described above AND there is a valid token when you run terraform.

  • thats not mfa thats generating a session token which is a different thing. OP needs a x-amz-mfa header with a number in their request or it will fail, this does not produce this. – krystan honour Jan 20 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.