Cross account role chaining for non-sso managed IAM roles...

[wealdling]

I'm not sure if I'm just not understanding the documentation, or if I am misreading the ability to do this. I have an IAM role with a trust relationship established to an SSO managed Role in a different account. I've tried accomplishing this with the "via" key, only defining the parent role in the other account, referencing the accountID:role as a value, referencing the accountFriendlyName:role as a value, all to no avail.

I've also tried to setup the prescribed .aws/config entry with source_profile pointing to the managed SSO Role, then running config-setup, with no success.

Given that it seems you're leveraging STS Assume Role recursively, I think this should be something that just works. Am I missing how to accomplish it/doing something wrong, or is this a valid feature request? I'd like to be able to run aws-sso eval unmanagedProfile and have it login via the referenced SSO managed account, then assume the unmanaged role and provide exports as normal.