README.md in aws_assume_role-0.1.2 vs README.md in aws_assume_role-0.2.0

- old
+ new

@@ -80,9 +80,32 @@ `--mfa-serial automatic` will look up your default attached multi-factor device, but you can specify a specific ARN. More options are available in the application help. Use `> aws-assume-role --help ` for help at any time. +Using MFA TOTP with a Yubikey +----------------------------- + +[Yubikeys support TOTP](https://developers.yubico.com/OATH/) this offers some +benefits over using a phone. One benefit is the TOTP token can be retrieved by +an API call rather than a user reading the token from the device. + +This allows developers to call AWS through aws-assume-role, providing an MFA +token without prompting for user input. To use this specify +`--yubikey-oath-name` when calling configure role. + +``` sh +> aws-assume-role configure role -p company-dev --source-profile company-sso \ +--role-arn=arn:aws:iam::000000000001:role/ViewEC2 --role-session-name=growthsmith \ +--mfa-serial automatic --yubikey-oath-name "Amazon Web Services:myuser@company-sso" +``` + +_Yubikey Support_: `aws-assume-role` uses the [smartcard gem](https://rubygems.org/gems/smartcard) +to connect to the Yubikey, this itself depends upon some C libraries being installed. They provide +[platform specific instructions](https://github.com/costan/smartcard/blob/master/BUILD#L19) +for installing these libraries PC/SC. + + Running applications -------------------- You can run another application using