def _get_mfa_sn(session):
    """
    Return serial number (ARN) for the MFA device accociated with
    the user's session profile if one exists.
    ISSUE: assumes only one device per user.
    """
    iam_client = session.client('iam')
    response = iam_client.list_mfa_devices()
    if response.get('MFADevices', []):
        return response['MFADevices'][0]['SerialNumber']
    return None
