mfa_serial does not work with U2F

[jr42]

When configuring a profile with MFA like this:

[profile myprofile]
role_arn = arn:aws:iam::123456789012:role/MyRole
source_profile = default
region = eu-west-1
mfa_serial = arn:aws:iam::123456789012:u2f/user/myuser/default-qwertzuioplkjhgfdsa

and try to assume the role I get this when pasting the U2F token by long-pressing my Yubikey:

T:\>aws --profile myprofile ec2 describe-regions
Enter MFA code for arn:aws:iam::123456789012:u2f/user/myuser/default-qwertzuioplkjhgfdsa:

An error occurred (ValidationError) when calling the AssumeRole operation: 2 validation errors detected: Value 'eifjccgncvncgfkjgjtjbfjilgtjrjbvgbvelhivvjlt' at 'tokenCode' failed to satisfy constraint: Member must have length less than or equal to 6; Value 'eifjccgncvncgfkjgjtjbfjilgtjrjbvgbvelhivvjlt' at 'tokenCode' failed to satisfy constraint: Member must satisfy regular expression pattern: [\d]*

Validatation should be extended to support U2F tokens.

[swetashre]

@jr42 - Thank you for your post. According to our documentation using U2F security keys for MFA is not currently supported in the AWS CLI and AWS API, or for access to MFA-protected API operations.

This feature would have to be first supported by API before it can be implemented in the CLI. Marking this as a feature request with a dependency.
We will close this issue for now until the API supports it .

[isarang]

Any update or anyone in AWS followed up on this?

[fstephany]

@isarang It seems that this is a duplicate of #3607
And nothing has moved since ages.

[debek]

Ohh my god. How it is possible :/

[staenker]

@[swetashre](https://github.com/swetashre) swetashre closed this as [completed]
I just hope this was an honest mistake and not your general approach to a definition of done|completed ...

[igor-nesterov-deltatre]

Any updates?

[mgrobaker]

I found this other issue that is open is related to U2F:
U2F Support · Issue #3607