import pulumi
import pulumi_aws as aws
import pulumi_onepassword as onepassword

# 1. Configure the 1Password Provider
provider_args = pulumi.ProviderResourceArgs.create(
    onepassword=onepassword.ProviderArgs(
        service_account_token=pulumi.get_secret("op_service_account_token"), 
    )
)

# 2. Fetch the Secret from 1Password
my_secret = onepassword.get_item(
    "my_secret",
    args=onepassword.GetItemArgs(
        vault="my_vault",
        uuid="my_secret_uuid",  # Replace with the actual UUID of your 1Password secret
    ),
    opts=pulumi.ResourceOptions(providers={"onepassword": provider_args}),
)

# 3. Use the Secret to Create an AWS Resource
# Example: Create an AWS IAM User with a programmatically generated password
iam_user = aws.iam.User("my_user")

iam_user_login_profile = aws.iam.UserLoginProfile(
    "my_user_login_profile",
    user=iam_user.name,
    password=my_secret.fields["password"].apply(lambda secret: secret), 
)

# 4. Output the IAM User's ARN
pulumi.export("iam_user_arn", iam_user.arn)