## Please see file perltidy.ERR
#!/usr/bin/perl

use strict;
use warnings;
use open ':std', ':encoding(UTF-8)';

use DateTime::Format::DateParse;

use lib '/var/app/orchard/collab/jgetter/perllib';
use Orchard::Session;
use Orchard::RunCommand;

my $profile = shift @ARGV || die "Must provide profile to use";
my $code    = shift @ARGV;

## first get the user
my $user = runaws("iam get-user --query 'User.[UserName]' --profile $profile");

## get MFA device
my $dev  = runaws("iam list-mfa-devices --user-name \"$user->[0]\" --query 'MFADevices[*].SerialNumber' --profile $profile");
if ( not defined $code ) {
    print "Your MFA device is: $dev->[0]\nEnter your MFA code now: ";
    $code = <STDIN>;
    $code =~ s/\n//g;
}

## get session token
my $aref = runaws(
"sts get-session-token --serial-number \"$dev->[0]\" --query 'Credentials.[SecretAccessKey,AccessKeyId,SessionToken,Expiration]' --token-code $code --profile $profile"
);

my ( $secret, $access, $session, $time ) = @{$aref};
my $dt = DateTime::Format::DateParse->parse_datetime($aref->[3])->ymd('');

my $credString =<<"!";

[session${dt}]
aws_access_key_id     = $access
aws_secret_access_key = $secret
aws_session_token     = $session

!

my $creds = FileHandle->new("$ENV{'HOME'}/.aws/credentials","a");
$creds->print($credString);
$creds->close;

print "export AWS_PROFILE=session{$dt}\n";

sub runaws {
    my $cmd = shift;
    my $out = Orchard::RunCommand::execute("aws $cmd");
    if ( $out->[1] ) {
        my $err = $out->[1];
        $err =~ s/\n//g;
        logMessage( 'error', $err );
        exit 1;
    }
    JSON::XS::decode_json( $out->[0] );
}

__END__
[default]
aws_access_key_id = AKIAIPEF23P7IYUQTKGQ
aws_secret_access_key = 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
region = us-west-2

echo "[default]" > "${HOME}"/.aws/credentials