Support setting the underlying terraform aws provider role per stage

chalice/config.py

@@ -372,6 +372,13 @@ def reserved_concurrency(self):
                                   varies_per_chalice_stage=True,
                                   varies_per_function=True)
 
+    @property
+    def terraform_assume_role(self):
+        # type: () -> str
+        return self._chain_lookup('terraform_assume_role',
+                                  varies_per_chalice_stage=True,
+                                  varies_per_function=False)
+
     def scope(self, chalice_stage, function_name):
         # type: (str, str) -> Config
         # Used to create a new config object that's scoped to a different

chalice/package.py

@@ -822,6 +822,7 @@ def generate(self, resources):
 
         for resource in resources:
             self.dispatch(resource, template)
+        self._inject_terraform_provider(template)
         return template
 
     def _fref(self, lambda_function, attr='arn'):
@@ -1406,6 +1407,16 @@ def _generate_domainname(self, resource, template):
         # type: (models.DomainName, Dict[str, Any]) -> None
         pass
 
+    def _inject_terraform_provider(self, template):
+        # type: (Dict[str, Any]) -> None
+        if self._config.terraform_assume_role is None:
+            return
+        provider = template.setdefault("provider", {})
+        aws_provider = provider.setdefault("aws", {})
+        aws_provider['assume_role'] = {
+            'role_arn': self._config.terraform_assume_role
+        }
+
 
 class AppPackager(object):
     def __init__(self,