#!/usr/bin/env bash
set -euo pipefail;

# role => profile in ~/.aws/config
# account => profile in ~/.aws/credentials
if [ $# != 3 ]; then
  echo "Start a new AWS session to enable aws-sdk and CLI to access resources"
  echo "  USAGE: $0 role account mfa-code"
  echo "  Example: $0 developer-at-gdb-infra-dev flastname-at-gdb-infra-dev 827103"
  exit 1
fi

role=${1}
profile=${2}
token_code=${3}

role_arn=$(aws configure get "${role}".role_arn)
mfa_serial=$(aws configure get "${role}".mfa_serial)

echo "Reading..."

read -r access_key secret session_token < <(
  aws sts assume-role \
    --profile "${profile}" \
    --duration-seconds 43200 \
    --role-arn "${role_arn}" \
    --role-session-name assumed-session \
    --serial-number "${mfa_serial}" \
    --token-code "${token_code}" \
    --output text \
    --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]"
)

aws configure set default.aws_access_key_id "$access_key"
aws configure set default.aws_secret_access_key "$secret"
aws configure set default.aws_session_token "$session_token"

access_key=$(aws configure get aws_access_key_id)
secret=$(aws configure get aws_secret_access_key)
session_token=$(aws configure get aws_session_token)

echo "; Updated [default] configs with these values in ~/.aws/credentials"
echo "aws_access_key_id = $access_key"
echo "aws_secret_access_key = $secret"
echo "aws_session_token = $session_token"