Maybe similar to #313 but instead of discussing on a closed issue:
Is it intentional that roles without a source_profile ("simple"?) are sorted above those with a source_profile ("complex"?)? In our organization, people have access to a team-based role but everyone also has access to a "ReadOnly" role.
An example config:
[base-myteamrole]
aws_account_id = 012345678901
role_name = base-myteamrole
[dev]
role_arn = arn:aws:iam::123456789012:role/crossaccount-myteamrole
source_profile = base-myteamrole
color = ff0000
[prod]
role_arn = arn:aws:iam::234567890123:role/crossaccount-myteamrole
source_profile = base-myteamrole
color = 00ff00
[dev-ReadOnly]
role_arn = arn:aws:iam::123456789012:role/ReadOnly
[prod-ReadOnly]
role_arn = arn:aws:iam::234567890123:role/ReadOnly
but when actually used, the order is:
dev-ReadOnly
prod-ReadOnly
dev
prod
We have ~100 AWS accounts and so we end up with ~100 ReadOnly profiles showing up first in the list above the more commonly used team-based profiles. I'd love some way to control this ordering better without making the ReadOnly profiles "complex" with a source_profile. That would work but makes the configuration even larger. Some people actually have many team-based roles so I'd need to create a ReadOnly profile for each Account*Team Role which explodes the config size.
Maybe similar to #313 but instead of discussing on a closed issue:
Is it intentional that roles without a
source_profile("simple"?) are sorted above those with asource_profile("complex"?)? In our organization, people have access to a team-based role but everyone also has access to a "ReadOnly" role.An example config:
but when actually used, the order is:
We have ~100 AWS accounts and so we end up with ~100 ReadOnly profiles showing up first in the list above the more commonly used team-based profiles. I'd love some way to control this ordering better without making the ReadOnly profiles "complex" with a
source_profile. That would work but makes the configuration even larger. Some people actually have many team-based roles so I'd need to create a ReadOnly profile for each Account*Team Role which explodes the config size.