AWS CLI MFA with 1password CLI lookup

aws_mfa_1pass.sh

#!/bin/bash

# Set the profile you want to use for MFA
SRC_PROFILE="default"
MFA_PROFILE="default-mfa"
MFA_DEVICE_ARN=$(aws configure get aws_mfa_device --profile "$SRC_PROFILE")
OP_VAULT_ITEM="<my-item-name>

if [ -z "$MFA_DEVICE_ARN" ]; then
  echo "Error: MFA device ARN not found in the ~/.aws/credentials file for profile $SRC_PROFILE"
  exit 1
fi

totp="$(otp item get "$OP_VAULT_ITEM" --otp)"
token="$(aws sts get-session-token --serial-number "$MFA_DEVICE_ARN" --token-code "$totp" --profile "$SRC_PROFILE")"

accessKey="$(echo "$token" | jq -r ".Credentials.AccessKeyId")"
secretKey="$(echo "$token" | jq -r ".Credentials.SecretAccessKey")"
sessionTk="$(echo "$token" | jq -r ".Credentials.SessionToken")"

aws configure set aws_access_key_id "$accessKey" --profile "$MFA_PROFILE"
aws configure set aws_secret_access_key "$secretKey" --profile "$MFA_PROFILE"
aws configure set aws_session_token "$sessionTk" --profile "$MFA_PROFILE"

echo "Loaded profile $MFA_PROFILE:"
aws sts get-caller-identity --profile "$MFA_PROFILE"