[meroje]

Pretty much the same situation here, we just disabled 2fa today on our aws integration because the web-only flow made it impossible to use cli tools.

[rectalogic]

You don't have to use a web-only flow for MFA. We use a tool that prompts for MFA the execs any CLI with the environment setup with the STS credentials e.g. https://gist.github.com/rectalogic/e99c10bd43a2a8f6542680953...