skills.rest
codepresso-dev
codepresso-devOFFICIAL
Explore all skills by this author →
GitHub

aws-login

Refreshes short-lived AWS MFA sessions and caches credentials for CLI and MCP access.

1|Updated Feb 16, 2026
Search Tags:#authentication#aws#cli#credentials#mfa#totp#session refresh
One-click install
npx skills add https://github.com/codepresso-dev/codepresso-ai-plugin --skill aws-login-codepresso-dev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-login
Source: https://github.com/codepresso-dev/codepresso-ai-plugin/tree/main/skills/aws-login
Command: npx skills add https://github.com/codepresso-dev/codepresso-ai-plugin --skill aws-login-codepresso-dev

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AWS sessions backed by MFA expire quickly, causing MFA_REQUIRED, ExpiredToken, or explicit-deny errors that block AWS CLI commands and MCP tools mid-workflow. This Skill renews the session so AWS operations can continue without manual credential juggling. ## Core Features & Use Cases - Session status check: Verifies whether MFA is configured and whether the current session is still valid before attempting a refresh. - MFA-based refresh: Prompts for a 6-digit TOTP code and mints a 4-hour session cached for all AWS channels (CLI, cloud-dev MCP, other AWS MCPs). - Guided error recovery: Handles bad codes, missing MFA serials, and temporary-credential environments with clear next steps. - Use Case: An aws command fails with ExpiredToken during a deployment. Invoke this Skill, enter your MFA code, and the original command can be retried immediately. ## Quick Start Ask the assistant to refresh the AWS MFA session and provide your 6-digit MFA code when prompted.

Frequently Asked Questions about aws-login

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I refresh an expired AWS MFA session?▼

Run the session refresh flow, which checks current status, prompts for your 6-digit MFA code, and mints a new 4-hour session. The refreshed credentials are cached so AWS CLI and MCP tools work again immediately.

Why does my AWS command fail with ExpiredToken or explicit deny?▼

MFA-backed AWS sessions are short-lived and expire after a few hours, causing ExpiredToken or explicit-deny errors. Refreshing the session with a valid MFA code restores access without reconfiguring credentials.

What do I need before refreshing an AWS MFA session?▼

AWS MFA must already be configured through the setup command, including a registered virtual TOTP device with an MFA serial. If the MFA serial is missing, register a virtual TOTP device and rerun setup first.

Does the AWS session refresh expose my secret keys or MFA code?▼

No. The flow never echoes SecretAccessKey, SessionToken, or the MFA code, and only reports the session expiration time after a successful refresh. The MFA code is used once and not stored.

Why does AWS session refresh fail inside temporary credentials?▼

Refreshing from within a temporary session returns a TEMP_SESSION error because new MFA sessions cannot be minted from temporary credentials. Run the refresh from a normal shell with your base credentials instead.

Related Skills

Explore More Software Engineering Skills→
mizchimizchi
320

aws-vault-mfa-iam

Provision MFA-protected AWS CLI sessions using aws-vault.

Community
Intermediate
chatermchaterm
50

aws-cli

Manage AWS cloud resources across EC2, S3, IAM, Lambda, and EKS.

Community
Intermediate
xalgordxalgord
954

detecting-aws-credential-exposure-with-trufflehog

Detect exposed AWS credentials in git repositories and CI/CD pipelines using TruffleHog and git-secrets.

Community
Intermediate
asanexampleasanexample
1

cluster-access

Configure kubeconfig for private EKS cluster access with AWS SSO and IAM roles.

Official
Intermediate