func GetBaseRoleARN(sess *session.Session) (string, error) {
	metadata := ec2metadata.New(sess)
	iamInfo, err := metadata.IAMInfo()
	if err != nil {
		return "", err
	}
	arn := strings.Replace(iamInfo.InstanceProfileArn, "instance-profile", "role", 1)
	baseRoleARN := strings.Split(arn, "/")
	if len(baseRoleARN) < 2 {
		return "", fmt.Errorf("failed to determine BaseRoleARN")
	}
	return fmt.Sprintf("%s/", baseRoleARN[0]), nil
}
GetBaseRoleARN gets base role ARN from EC2 metadata service.
package main
import (
	"fmt"
	"strings"
	"time"
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/arn"
	"github.com/aws/aws-sdk-go/aws/ec2metadata"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/sts"
	"github.com/aws/aws-sdk-go/service/sts/stsiface"
)
const (
	roleARNSuffix          = ":role"
	roleSessionNameMaxSize = 64
)
type CredentialsGetter interface {
	Get(role string, sessionDuration time.Duration) (*Credentials, error)
}
type Credentials struct {
	RoleARN         string
	AccessKeyID     string
	SecretAccessKey string
	SessionToken    string
	Expiration      time.Time
}
type STSCredentialsGetter struct {
	svc               stsiface.STSAPI
	baseRoleARN       string
	baseRoleARNPrefix string
}
func NewSTSCredentialsGetter(sess *session.Session, baseRoleARN, baseRoleARNPrefix string, configs ...*aws.Config) *STSCredentialsGetter {
	return &STSCredentialsGetter{
		svc:               sts.New(sess, configs...),
		baseRoleARN:       baseRoleARN,
		baseRoleARNPrefix: baseRoleARNPrefix,
	}
}
func (c *STSCredentialsGetter) Get(role string, sessionDuration time.Duration) (*Credentials, error) {
	roleARN := c.baseRoleARN + role
	if strings.HasPrefix(role, c.baseRoleARNPrefix) {
		roleARN = role
	}
	roleSessionName, err := normalizeRoleARN(roleARN, c.baseRoleARNPrefix)
	if err != nil {
		return nil, err
	}
	params := &sts.AssumeRoleInput{
		RoleArn:         aws.String(roleARN),
		RoleSessionName: aws.String(roleSessionName),
		DurationSeconds: aws.Int64(int64(sessionDuration.Seconds())),
	}
	resp, err := c.svc.AssumeRole(params)
	if err != nil {
		return nil, err
	}
	return &Credentials{
		RoleARN:         roleARN,
		AccessKeyID:     aws.StringValue(resp.Credentials.AccessKeyId),
		SecretAccessKey: aws.StringValue(resp.Credentials.SecretAccessKey),
		SessionToken:    aws.StringValue(resp.Credentials.SessionToken),
		Expiration:      aws.TimeValue(resp.Credentials.Expiration),
	}, nil
}