Notes

Update: just use AWS Vault.

SST won’t work if the AWS credentials you’re using have MFA enabled. You’ll get:

Error creating AWS session: AssumeRoleTokenProviderNotSetError: assume role with MFA enabled, but AssumeRoleTokenProvider session option not set.

The easiest way to make it work is to set up a new AWS cli profile with credential_process. If you’re using the default profile, for example, you can set up something like this:

[profile sst-mfa]
region = ap-northeast-1 # don’t forget to set the same region as the original profile
credential_process = aws configure export-credentials

And then setting the AWS_PROFILE environment variable before running any SST command:

AWS_PROFILE=default-sst sst dev

If you’re using any other AWS profile, you need to set the --profile parameter accordling:

[profile sst-mfa]
region = ap-northeast-1 # don’t forget to set the same region as the original profile
credential_process = aws configure export-credentials —profile original-profile

Note that aws configure export-credentials was introduced in AWS cli 2.9.0, so please make sure you have that version or later by running aws --version.