Feature request: Introducing “sudo” functionality into Granted

Context: From Iain Elder

Hi, all. I've been a lurker for a while but I just thought of a use case that would give me a compelling reason to switch to using granted from my current janky custom setup. Does granted have some sort of "sudo" capability for AWS profiles? By default I set my CLI to the "read-only" profile for the account I work in. Maybe 1 command in 100 actually needs to modify something in the account. Guess which command fails with "access denied" before I realize I have to use the "admin" profile! To switch to the admin profile I need to set its whole explicit name in the command or in the script, which is more typing and perhaps makes the commands less reusable across accounts. Obviously typing sudo aws doesn't work, but maybe granted would define a command such as sudoaws or similar that would call the aws command with the correct elevated privilege for the context.

From @chrnorm

I love this idea. At the moment we don’t do this, but would love ideas from everyone as to how this could work. The use case here is introducing “sudo” functionality into Granted, to elevate into an admin profile for a particular AWS command: granted sudo aws s3 rm <object> As you’ve mentioned, Granted would need to know about the default and elevated role for an account. Perhaps we could do this with an attribute on the profile:
[profile account-a/default] # profile naming convention doesn't matter
... regular profile config here
granted_default_profile_for = account-a
[profile account-a/sudo] # profile naming convention doesn't matter
... regular profile config here
granted_sudo_profile_for = account-a
When you run assume, you’d just see account-a appear, and if you run assume account-a, you get the default profile for that account (account-a/default). The default role should be something like ViewOnlyAccess, which would mean a command like aws s3 rm

common-fate / granted

Feature request: Introducing “sudo” functionality into Granted #612