Accessing IAM Roles with Contract Tests

Hi, my current resource AWS::DataSync::LocationS3 requires a property 'BucketAccessRoleArn', which is an IAM role for an S3 bucket. I believe this forces the DataSync API to use IAM API's in order to access the role, which gives an "Error occurred while getting IAM Role" for contract tests.

I believe the tests currently get temporary credentials in the same way as invoking "aws sts get-session-token". But these temporary credentials do not allow calls for IAM API operations as stated here in the 'Permissions' section: https://docs.aws.amazon.com/cli/latest/reference/sts/get-session-token.html

I am able to get SAM testing to work by using MFA authentication in the request: "aws sts get-session-token --serial number --token-code ", but I am unable to do something similar for contract tests.

実装ファイルは指定されていません。まず contract-test の認証情報フローを再現し、issue に記載されている SAM testing および AWS STS get-session-token の動作と比較してください。BucketAccessRoleArn が参照する IAM role に、IAM role エラーなしで contract tests からアクセスでき、必要な MFA シナリオも含まれていれば完了です。

索引モデルが issue の本文から書いたものです。