Add --sso-role to override the IAM Identity Center role

[winebarrel]

awsmcproxy --sso-role ReadOnlyAccess     # or $AWSMCPROXY_SSO_ROLE

Replaces sso_role_name for every profile, keeping each profile's own sso_account_id and SSO session. One flag covers every profile even across accounts, because only the role name changes.

This is how you stop an agent writing to AWS. Hiding write-capable tools would not be a boundary; a role that lacks the permissions is one.

Implementation

One option, no hand-rolled credential wiring:

awsconfig.WithSSOProviderOptions(func(o *ssocreds.Options) {
	o.RoleName = proxy.ssoRole
})

ssocreds.New takes the role name as a constructor argument and then applies the option functions, so this wins over sso_role_name. The rest of the SDK's credential resolution is untouched.

The SSO access token is per session rather than per role, so the swap needs no new login -- the cached token from aws sso login is reused and only the GetRoleCredentials role name differs.

Why SSO only

GetRoleCredentials takes an account ID and a role name. AssumeRole takes the role's full ARN, which embeds the account ID, so a single flag could not cover profiles in different accounts without first resolving each account and building the ARN.

A profile that does not use IAM Identity Center never reaches the SSO branch of the credential chain, so the option is never consulted and the profile keeps its own credentials. No detection code, and nothing to go stale.

A role that is not assigned to you in that account fails when the credentials are first used, not at startup -- there is no way to know earlier without calling the portal.

Tests

A fake IAM Identity Center portal answers GetRoleCredentials, so the tests assert what was actually asked for:

• with --sso-role, role_name=ReadOnlyAccess while account_id stays the profile's
• without it, role_name is the profile's AdministratorAccess
• it also applies to the startup connection, which names no profile
• a non-SSO profile still signs with its own access key

Coverage stays at 99.0%.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.40%. Comparing base (5b16b77) to head (17eb846).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main       #9      +/-   ##
==========================================
+ Coverage   98.38%   98.40%   +0.02%     
==========================================
  Files           5        5              
  Lines         372      377       +5     
==========================================
+ Hits          366      371       +5     
  Misses          3        3              
  Partials        3        3              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.