add mfa support to assume role

lib/terraforming/cli.rb

@@ -6,6 +6,8 @@ class CLI < Thor
     class_option :profile, type: :string, desc: "AWS credentials profile"
     class_option :region, type: :string, desc: "AWS region"
     class_option :assume, type: :string, desc: "Role ARN to assume"
+    class_option :mfa_serial, type: :string, desc: "Serial number of MFA device"
+    class_option :token_code, type: :string, desc: "Token code from MFA device"
     class_option :use_bundled_cert,
                  type: :boolean,
                  desc: "Use the bundled CA certificate from AWS SDK"
@@ -235,16 +237,18 @@ def snss
     def configure_aws(options)
       Aws.config[:credentials] = Aws::SharedCredentials.new(profile_name: options[:profile]) if options[:profile]
       Aws.config[:region] = options[:region] if options[:region]
-
       if options[:assume]
-        args = { role_arn: options[:assume], role_session_name: "terraforming-session-#{Time.now.to_i}" }
+        args = { role_arn: options[:assume], role_session_name: "terraforming-session-#{Time.now.to_i}"}
+        args[:serial_number] = options[:mfa_serial] if options[:mfa_serial]
+        args[:token_code] = options[:token_code] if options[:token_code]
         args[:client] = Aws::STS::Client.new(profile: options[:profile]) if options[:profile]
         Aws.config[:credentials] = Aws::AssumeRoleCredentials.new(args)
       end
 
       Aws.use_bundled_cert! if options[:use_bundled_cert]
     end
 
+
     def execute(klass, options)
       configure_aws(options)
       result = options[:tfstate] ? tfstate(klass, options[:merge]) : tf(klass)

spec/lib/terraforming/cli_spec.rb

@@ -555,6 +555,18 @@ module Terraforming
           end
         end
 
+        context "with --assumes and --mfa_device without --tfstate" do
+          it "should switch roles using mfa and export tf" do
+            expect(klass).to receive(:tf).with(no_args)
+            described_class.new.invoke(command, [], {
+              assume: 'arn:aws:iam::123456789123:role/test-role',
+              region: 'ap-northeast-1',
+              mfa_serial: "arn:aws:iam::123456789012:mfa/test",
+              token_code: "123456"
+            })
+          end
+        end
+
         context "with --assumes and --tfstate" do
           it "should switch roles and export tfstate" do
             expect(klass).to receive(:tfstate).with(no_args)
@@ -566,6 +578,19 @@ module Terraforming
           end
         end
 
+        context "with --assumes and --mfa_device and --tfstate" do
+          it "should switch roles using mfa and export tfstate" do
+            expect(klass).to receive(:tfstate).with(no_args)
+            described_class.new.invoke(command, [], {
+              assume: 'arn:aws:iam::123456789123:role/test-role',
+              region: 'ap-northeast-1',
+              mfa_serial: "arn:aws:iam::123456789012:mfa/test",
+              token_code: "123456",
+              tfstate: true
+            })
+          end
+        end
+
         context "with --assumes and --tfstate --merge TFSTATE" do
           it "should switch roles and export merged tfstate" do
             expect(klass).to receive(:tfstate).with(no_args)
@@ -577,6 +602,20 @@ module Terraforming
             })
           end
         end
+
+        context "with --assumes and --mfa_device and --tfstate --merge TFSTATE" do
+          it "should switch roles using mfa and export merged tfstate" do
+            expect(klass).to receive(:tfstate).with(no_args)
+            described_class.new.invoke(command, [], {
+              assume: 'arn:aws:iam::123456789123:role/test-role',
+              region: 'ap-northeast-1',
+              mfa_serial: "arn:aws:iam::123456789012:mfa/test",
+              token_code: "123456",
+              tfstate: true,
+              merge: tfstate_fixture_path
+            })
+          end
+        end
       end
     end
   end