Hacker News Reader

> I was very surprised to see that awscli still doesn't support Yubikeys.

Singular it does, per IAM user.

But only for the web console, not via the CLI. The API for generating short-term keys (which aws-vault uses) only supports TOTP, not FIDO/U2F/WebAuthn.

https://github.com/aws/aws-cli/issues/3607

Sure, but I was responding to 'Yubikey', not about any specific protocol.

I'm not claiming it's ideal, but it works, with one Yubikey per IAM user:

https://aws.amazon.com/premiumsupport/knowledge-center/authe...

> I was very surprised to see that awscli still doesn't support Yubikeys

Thanks, but you cannot[0] use hardware keys on the terminal.

[0] https://github.com/aws/aws-cli/issues/3607

That's about U2F, which is just one protocol that (most) Yubikeys support.

Reply on news.ycombinator.com