I am trying to retrieve session token on the AWS CLI like so:

aws sts get-session-token --serial-number arn-string --token-code mfacode

where

• arn-string is copied from the IAM management console, security credentials for the assigned MFA device,format like arn:aws:iam:<number>:mfa/<name>
• mfacode is taken from the registered virtual mfa device

error:

An error occurred (InvalidClientTokenId) when calling the GetSessionToken operation: The security token included in the request is invalid.

However, I use that MFA device to login to the console in the browser just fine

I have only a default profile in my ~/.aws/, but I don't see how this would have any influence.

tried this:

1. try multiple time to ensure no mfa flip-over has happened
2. delete MFA device assignment and reassign device -- same error
3. ommitting --token-code in hope to have it prompt me for the MFA device token -- same error
4. using the arn:aws:iam:<number>:user/<name> -- same error as can be expected since the aws get-session-id help clearly states it needs to be the arn of the mfa device

I figure this has to do with arn-string rather than the token, but what ? Any idea on what causes this problem most welcome.

Regards, Olaf