Feature request: dynamic config template or allow dynamic roles generation

[Marakai]

I would like to be able to dynamically generate Roles based on the accounts.

For example, if I have:

accounts:
  central:
    id: 123456678910
    parent: true
    saml_provider: ProdADFS
  dev1:
    id: 109876543210
  dev2:
    id: 309876543210
  prod:
    id: 209876543210

I would like to be able to generate roles as:

roles:
  <Account>Admin:
    trusts:
      - parent
    managed_policies:
      - arn:aws:iam::aws:policy/AdministratorAccess
    in_accounts:
      - <account>
  <Account>ReadOnly:
      trusts:
        - parent
      managed_policies:
        - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
      in_accounts:
        - <account>

with <Account> and <account> substituted with all accounts from accounts:. This would generate specific roles for each account. Said roles would have further managed policies that could, for example, make sure of conditions the permit usage based on conditions matching the SAML user ID, etc.

[nhawkins04]

@Marakai - To better understand this: Would you also be indicating that the "Admin" role could have a different level of access in each account? Or is it the same role and this is more of a naming requirement where the Admin role is prefixed with the <account_name>?

[Marakai]

My original requirement was indeed just for naming, but I like your idea! That would indeed be an added bonus.