Indeed, this is a pain. I've been fighting with it for the whole day yesterday, but managed to get it working, let's see if our cases are similar enough. My guess is that the *usual* `aws configure` configuration with a MFA ARN + the AWS SDK used to develop *kubectl* are not entirely compatible: I have two profiles set for this, one that has its *mfa_serial_arn* and *role_arn* that works as follows: * First **aws** command I type, I get prompted for MFA token * From there onwards, while session is active, I can work without typing in more tokens. * *kubectl* asks for a token EVERY SINGLE TIME. This is bad. Now, I set a different profile, without any of the above, and I do the following: ``` keys=($(aws sts assume-role --role-arn <ARN_OF_DELEGATED_ROLE> \ --role-session-name <RANDOM_UNIQUE_NAME> \ --serial-number <ARN_OF_MFA_DEVICE>\ --token-code \ --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text)) # profile used here will be configured in ~/.aws/credentials export AWS_PROFILE=<PROFILE YOU WANT> aws configure set aws_access_key_id ${temp_keys[0]} aws configure set aws_secret_access_key ${temp_keys[1]} aws configure set aws_session_token ${temp_keys[2]} ``` This creates a **temporary valid** aws profile, that can be used **BOTH** with the aws cli, and kubectl.