# ansible ec2.py discovery with assume\_role & MFA

**URL:** <https://forum.ansible.com/t/ansible-ec2-py-discovery-with-assume-role-mfa/22609>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [September 21, 2016, 10:40pm UTC](https://forum.ansible.com/t/ansible-ec2-py-discovery-with-assume-role-mfa/22609 "2016-09-21T22:40:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![matthieu.isoard](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@matthieu.isoard](https://forum.ansible.com/u/matthieu.isoard)\
**Post date:** [September 21, 2016, 10:40pm UTC](https://forum.ansible.com/t/ansible-ec2-py-discovery-with-assume-role-mfa/22609/1 "2016-09-21T22:40:43Z")

</div>

Hi

Before using Ansible with some roles I prepared, I wanted to check the ec2.py autodiscovery script. However, all the accounts I have setup on AWS need to login to a first account which uses MFA & then assume a role before being able to do something.  
It appears that I cannot make it work, even if I have created the right ~/.aws/config & ~/.aws/credentials files.  
ec2.py just seems missing to assume\_role, read MFA & ask the token…  
I have found a fork of ec2.py for the assume\_role part, but I am still missing the MFA part.  
Does someone have the solution?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [September 23, 2016, 12:41pm UTC](https://forum.ansible.com/t/ansible-ec2-py-discovery-with-assume-role-mfa/22609/2 "2016-09-23T12:41:41Z")

</div>

I think you are looking this thing:

`  
#!/bin/bash

# Requirement:

# - awscli

# - jq