title: How to assume a role that requires an MFA from within an EC2 instance with an instance profile attached?
body: <p>I want to allow an EC2 instance to assume a role from a different account. The EC2 has a role attached that allows it to assume any role from another account called myAdmin. If the myAdmin role on the other accounts has my account number listed as a trusted entity, then I can assume the role successfully.</p>
  
  <p>However, the myAdmin roles on the other accounts also require anyone assuming the role to be authenticated using MFA because the role gives admin access to the account. This condition causes the assume role action to fail.</p>
  
  <p>I am assuming it fails because obviously the EC2 instance did not authenticate using an MFA (the instance profile was just attached to it when it was instantiated). I have tried passing in the MFA serial number and token of the root account using the following python (boto) code but haven't had any luck.</p>
  
  <pre><code>sts_conn = boto.sts.STSConnection()
  role_creds = sts_conn.assume_role(role_arn='arn:aws:iam::OTHER_ACCT_NUM:role/myAdmin',
                                    role_session_name='myAdminSession',
                                    mfa_serial_number='arn:aws:iam::MY_ACCT_NUM:mfa/root-account-mfa-device',
                                    mfa_token=TOKEN)
  </code></pre>
  
  <p>I get the following error:</p>
  
  <pre><code>boto.exception.BotoServerError: BotoServerError: 403 Forbidden
  &lt;ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/"&gt;
  &lt;Error&gt;
  &lt;Type&gt;Sender&lt;/Type&gt;
  &lt;Code&gt;AccessDenied&lt;/Code&gt;
  &lt;Message&gt;MultiFactorAuthentication failed, unable to validate MFA code. Please verify your MFA serial number is valid and associated with this user.&lt;/Message&gt;
  &lt;/Error&gt;
  &lt;RequestId&gt;d108e1aa-a2a2-11e5-9bbf-8fce06e22779&lt;/RequestId&gt;
  &lt;/ErrorResponse&gt;
  </code></pre>
  
  <p>I think this fails because the root MFA credentials isn't really associated with the EC2 instance credentials.</p>
  
  <p>Can MFA credentials be used with an EC2 instance profile to assume a role that requires MFA?
  And if so, how would I go about doing this?</p>