This message was deleted.

I do it that way with typescript and temp creds coming from saml2aws. Or if you're running it on an instance that has the ability to assume other roles, you can create additional providers which will pull creds with something like (i'm sure there's a go equiv)

new aws.Provider(`${account.id}-provider`, {
            assumeRole: {
                roleArn: `arn:aws:iam::${account.id}:role/some_other_role`,
                sessionName: "PulumiSession",
            },
            region: 'us-east-1,
        })