s3 remote: DVC asks MFA code for each file on push/pull

[shcheklein]

Context:

https://discordapp.com/channels/485586884165107732/485596304961962003/644313703038189568

Might be related:

boto/boto3#1179

[shcheklein]

Temporary workaround:

https://discordapp.com/channels/485586884165107732/485596304961962003/644334026311598124

[TimothyHyndman]

To get the above workaround working, I had to remove the mfa_serial = ... line from the profile I was using in ~/.aws/config

[efiop]

Might be solved by caching the session #2473 (comment) , but need to confirm.

[Suor]

Looked it up. This probably won't be solved by threadsafe caching s3 prop. I am surprised MFA work with dvc at all though.

Need to ask the user how MFA device is set.

[efiop]

Another user is experiencing this same issue. https://discordapp.com/channels/485586884165107732/485596304961962003/656143281163599885

[efiop]

We could solve it the same way we do it with passphrase-s for ssh, by using ask_password config option, but maybe we could auto-detect this somehow. Need to research this.

[efiop]

From https://docs.aws.amazon.com/cli/latest/topic/config-vars.html

If you specify an mfa_serial, then the first time an AssumeRole call is made, you will be prompted to enter the MFA code. Subsequent commands will use the cached temporary credentials. However, when the temporary credentials expire, you will be re-prompted for another MFA code.

need to take a closer look.