Accessing IAM Roles with Contract Tests

Hi, my current resource AWS::DataSync::LocationS3 requires a property 'BucketAccessRoleArn', which is an IAM role for an S3 bucket. I believe this forces the DataSync API to use IAM API's in order to access the role, which gives an "Error occurred while getting IAM Role" for contract tests.

I believe the tests currently get temporary credentials in the same way as invoking "aws sts get-session-token". But these temporary credentials do not allow calls for IAM API operations as stated here in the 'Permissions' section: https://docs.aws.amazon.com/cli/latest/reference/sts/get-session-token.html

I am able to get SAM testing to work by using MFA authentication in the request: "aws sts get-session-token --serial number --token-code ", but I am unable to do something similar for contract tests.

Non vengono nominati file di implementazione. Inizia riproducendo il flusso delle credenziali di contract-test e confrontalo con SAM testing e con il comportamento di AWS STS get-session-token descritto nell’issue. Il lavoro è completato quando i contract tests possono accedere all’IAM role a cui fa riferimento BucketAccessRoleArn senza l’errore IAM role, incluso lo scenario MFA richiesto.

Scritto dal modello di indicizzazione a partire dal testo della issue.