Amazon EKS from local kubectl does not cache MFA token/session
Indeed, this is a pain. I've been fighting with it for the whole day yesterday, but managed to get it working, let's see if our cases are similar enough.

My guess is that the usual aws configure configuration with a MFA ARN + the AWS SDK used to develop kubectl are not entirely compatible: I have two profiles set for this, one that has its mfa_serial_arn and role_arn that works as follows:


First aws command I type, I get prompted for MFA token 
From there onwards, while session is active, I can work without typing in more tokens.
kubectl asks for a token EVERY SINGLE TIME.


This is bad.

Now, I set a different profile, without any of the above, and I do the following:

```

keys=($(aws sts assume-role --role-arn &lt;ARN_OF_DELEGATED_ROLE&gt; \
   --role-session-name  &lt;RANDOM_UNIQUE_NAME&gt; \
   --serial-number &lt;ARN_OF_MFA_DEVICE&gt;\
   --token-code  \
    --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text))

# profile used here will be configured in ~/.aws/credentials
export AWS_PROFILE=&lt;PROFILE YOU WANT&gt;

aws configure set aws_access_key_id ${temp_keys[0]}
aws configure set aws_secret_access_key ${temp_keys[1]}
aws configure set aws_session_token ${temp_keys[2]}


```

This creates a temporary valid aws profile, that can be used BOTH with the aws cli, and kubectl.