feature: Support for cross account-role assumption

[wayne-folkes]

🔖 Feature description

I would like to be able to specify the role ARN that each plugin should use when when querying those services associated with each plugin.

🎤 Context

In our AWS environment we have over 100 accounts. We run backstage in an account purposed for running workloads in EKS. We have a separate account for ECR and a different account that acts as our AWS config agregator and AWS Resource Explorer agregator.

✌️ Possible Implementation

I would like to have a default role for each plugin and each component should be able to override that value when they maybe using a different account than the one provided by the platform team.

[niallthomson]

Hi @wayne-folkes

Currently it should be possible to use a separate account for each of the concerns you mentioned there via the AWS auth mechanism provided in upstream in Backstage. The account ID from the ARNs of the various annotations should trigger cross-account auth.

Is this not working for your situation?