Repository: chanzuckerberg/fogg
Pull request #475 (2020-05-18 20:29:58)

[feature] support roles for s3 backends
Enable configuring s3 backends with IAM roles.

Similar to our change to allow specifying roles (rather than profiles) for providers, we allow specifying a role as an alternative to a profile. This will enable cases like TFE where it is hard to configure roles.

### Test Plan
* [x] unit tests
* [x] manual test on shared-infra

### References
*

codecov-commenter: # [Codecov](https://codecov.io/gh/chanzuckerberg/fogg/pull/475?src=pr&el=h1) Report
> Merging [#475](https://codecov.io/gh/chanzuckerberg/fogg/pull/475?src=pr&el=desc) into [master](https://codecov.io/gh/chanzuckerberg/fogg/commit/71e5be548b06128798f599621107d793048ab5b0&el=desc) will **decrease** coverage by `1.85%`.
> The diff coverage is `61.81%`.

[![Impacted file tree graph](https://codecov.io/gh/chanzuckerberg/fogg/pull/475/graphs/tree.svg?width=650&height=150&src=pr&token=57DhtZ7g2A)](https://codecov.io/gh/chanzuckerberg/fogg/pull/475?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master     #475      +/-   ##
==========================================
- Coverage   61.22%   59.36%   -1.86%     
==========================================
  Files          19       19              
  Lines        1960     1996      +36     
==========================================
- Hits         1200     1185      -15     
- Misses        607      653      +46     
- Partials      153      158       +5     
```


| [Impacted Files](https://codecov.io/gh/chanzuckerberg/fogg/pull/475?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [config/v2/config.go](https://codecov.io/gh/chanzuckerberg/fogg/pull/475/diff?src=pr&el=tree#diff-Y29uZmlnL3YyL2NvbmZpZy5nbw==) | `8.60% <0.00%> (-0.42%)` | :arrow_down: |
| [config/v2/validation.go](https://codecov.io/gh/chanzuckerberg/fogg/pull/475/diff?src=pr&el=tree#diff-Y29uZmlnL3YyL3ZhbGlkYXRpb24uZ28=) | `78.85% <60.00%> (-0.61%)` | :arrow_down: |
| [config/v2/resolvers.go](https://codecov.io/gh/chanzuckerberg/fogg/pull/475/diff?src=pr&el=tree#diff-Y29uZmlnL3YyL3Jlc29sdmVycy5nbw==) | `48.42% <73.07%> (-8.41%)` | :arrow_down: |
| [plan/plan.go](https://codecov.io/gh/chanzuckerberg/fogg/pull/475/diff?src=pr&el=tree#diff-cGxhbi9wbGFuLmdv) | `84.87% <80.00%> (-0.48%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/chanzuckerberg/fogg/pull/475?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/chanzuckerberg/fogg/pull/475?src=pr&el=footer). Last update [12f8038...3f1287b](https://codecov.io/gh/chanzuckerberg/fogg/pull/475?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/config/v2/config.go b/config/v2/config.go
index 829826cc..60152296 100644
--- a/config/v2/config.go
+++ b/config/v2/config.go
@@ -180,6 +180,7 @@ type Backend struct {
 	DynamoTable *string `yaml:"dynamodb_table,omitempty"`
 	Profile     *string `yaml:"profile,omitempty"`
 	Region      *string `yaml:"region,omitempty"`
+	Role        *string `yaml:"role,omitempty"`
 
 	// fields used for remote backend
 	HostName     *string `yaml:"host_name,omitempty"`
@@ -358,10 +359,22 @@ func (c *Config) Generate(r *rand.Rand, size int) reflect.Value {
 	}
 
 	randCommon := func(r *rand.Rand, s int) Common {
+		var backendRole, backendProfile *string
+
+		if r.Float32() < 0.5 {
+			backendRole = randStringPtr(r, s)
+		}
+
+		if r.Float32() < 0.5 {
+			backendProfile = randStringPtr(r, s)
+		}
+
 		c := Common{
 			Backend: &Backend{
-				Bucket: randStringPtr(r, s),
-				Region: randStringPtr(r, s),
+				Bucket:  randStringPtr(r, s),
+				Region:  randStringPtr(r, s),
+				Role:    backendRole,
+				Profile: backendProfile,
 			},
 			ExtraVars: randStringMap(r, s),
 			Owner:     randStringPtr(r, s),
diff --git a/config/v2/resolvers.go b/config/v2/resolvers.go
index 85d84f4c..e0fc0643 100644
--- a/config/v2/resolvers.go
+++ b/config/v2/resolvers.go
@@ -137,20 +137,54 @@ func ResolveAWSProvider(commons ...Common) *AWSProvider {
 
 // ResolveBackend returns the Backend configuration for a given component, after applying all inheritance rules
 func ResolveBackend(commons ...Common) *Backend {
-	kind := lastNonNil(BackendKindGetter, commons...)
 
-	// This feels like a somewhat hacky way to do this, but not sure of a better place yet
-	if kind == nil {
-		kind = util.StrPtr("s3")
-	}
+	var kind, accountID, bucket, dynamoTable, profile, region, hostName, organization, role *string
+
+	kind = util.StrPtr("s3")
+
+	for _, c := range commons {
+		if c.Backend != nil {
+			b := c.Backend
+			if b.Kind != nil {
+				kind = b.Kind
+			}
+
+			if b.AccountID != nil {
+				accountID = b.AccountID
+			}
+
+			if b.Bucket != nil {
+				bucket = b.Bucket
+			}
 
-	accountID := lastNonNil(BackendAccountIDGetter, commons...)
-	bucket := lastNonNil(BackendBucketGetter, commons...)
-	dynamoTable := lastNonNil(BackendDynamoTableGetter, commons...)
-	profile := lastNonNil(BackendProfileGetter, commons...)
-	region := lastNonNil(BackendRegionGetter, commons...)
-	hostName := lastNonNil(BackendHostNameGetter, commons...)
-	organization := lastNonNil(BackendOrganizationGetter, commons...)
+			if b.DynamoTable != nil {
+				dynamoTable = b.DynamoTable
+			}
+
+			if b.Region != nil {
+				region = b.Region
+			}
+
+			// Profile and Role are mutually exclusive, so if one is set then we set the other to
+			// nil Our validations in validateBackend will assure that they are not both set or missing in the
+			// same stuct.
+			if b.Profile != nil {
+				profile = b.Profile
+				role = nil
+			} else if b.Role != nil {
+				role = b.Role
+				profile = nil
+			}
+
+			if b.HostName != nil {
+				hostName = b.HostName
+			}
+
+			if b.Organization != nil {
+				organization = b.Organization
+			}
+		}
+	}
 
 	return &Backend{
 		Kind: kind,
@@ -162,6 +196,7 @@ func ResolveBackend(commons ...Common) *Backend {
 		Region:       region,
 		HostName:     hostName,
 		Organization: organization,
+		Role:         role,
 	}
 }
 
diff --git a/config/v2/validation.go b/config/v2/validation.go
index 92704cd8..3c3d308d 100644
--- a/config/v2/validation.go
+++ b/config/v2/validation.go
@@ -113,8 +113,13 @@ func ValidateBackend(backend *Backend, component string) error {
 			errs = multierror.Append(errs, fmt.Errorf("when backend kind == 's3', region is required (component %s)", component))
 		}
 
-		if backend.Profile == nil {
-			errs = multierror.Append(errs, fmt.Errorf("when backend kind == 's3', profile is required (component %s)", component))
+		if (backend.Profile != nil && backend.Role != nil) ||
+			(backend.Profile == nil && backend.Role == nil) {
+			errs = multierror.Append(errs, fmt.Errorf("when backend kind == 's3', exactly one of profile or role must be set (component %s)", component))
+		}
+
+		if backend.Role != nil && backend.AccountID == nil {
+			errs = multierror.Append(errs, fmt.Errorf("when backend kind == 's3' and role is set, account_id must also be set (component %s)", component))
 		}
 
 		return errs.ErrorOrNil()
diff --git a/plan/plan.go b/plan/plan.go
index 388e73d0..c86d8a95 100644
--- a/plan/plan.go
+++ b/plan/plan.go
@@ -94,8 +94,9 @@ func (c CIComponent) generateCIConfig(
 		Command: c.Command,
 	})
 
-	if backend.S3 != nil && backend.S3.AccountID != nil {
-		ciConfig.AWSProfiles[backend.S3.Profile] = AWSRole{
+	if backend.S3 != nil && backend.S3.AccountID != nil && backend.S3.Profile != nil {
+		p := *backend.S3.Profile
+		ciConfig.AWSProfiles[p] = AWSRole{
 			AccountID: *backend.S3.AccountID,
 			RoleName:  c.AWSRoleName,
 		}
@@ -130,7 +131,7 @@ type AWSProvider struct {
 	Alias     *string     `yaml:"alias"`
 	Profile   *string     `yaml:"profile"`
 	Region    string      `yaml:"region"`
-	Role      *string     `yaml:"role"`
+	RoleArn   *string     `yaml:"role_arn"`
 	Version   string      `yaml:"version"`
 }
 
@@ -198,11 +199,12 @@ type Backend struct {
 type S3Backend struct {
 	AccountID   *string `yaml:"account_id,omitempty"`
 	AccountName string  `yaml:"account_name"`
-	Profile     string  `yaml:"profile"`
-	Region      string  `yaml:"region"`
 	Bucket      string  `yaml:"bucket"`
 	DynamoTable *string `yaml:"dynamo_table"`
 	KeyPath     string  `yaml:"key_path"`
+	Profile     *string `yaml:"profile"`
+	Region      string  `yaml:"region"`
+	RoleArn     *string `yaml:"role_arn"`
 }
 
 // RemoteBackend represents a plan to configure a terraform remote backend
@@ -442,13 +444,18 @@ func resolveComponentCommon(commons ...v2.Common) ComponentCommon {
 	var awsPlan *AWSProvider
 	awsConfig := v2.ResolveAWSProvider(commons...)
 	additionalProviders := []AWSProvider{}
+	var roleArn *string
 
 	if awsConfig != nil {
+		if awsConfig.Role != nil {
+			tmp := fmt.Sprintf("arn:aws:iam::%s:role/%s", *awsConfig.AccountID, *awsConfig.Role)
+			roleArn = &tmp
+		}
 		awsPlan = &AWSProvider{
 			AccountID: *awsConfig.AccountID,
 			Profile:   awsConfig.Profile,
 			Region:    *awsConfig.Region,
-			Role:      awsConfig.Role,
+			RoleArn:   roleArn,
 			Version:   *awsConfig.Version,
 		}
 
@@ -461,7 +468,7 @@ func resolveComponentCommon(commons ...v2.Common) ComponentCommon {
 					Alias:     &region,
 					Profile:   awsConfig.Profile,
 					Region:    region,
-					Role:      awsConfig.Role,
+					RoleArn:   awsConfig.Role,
 					Version:   *awsConfig.Version,
 				})
 		}
@@ -588,12 +595,19 @@ func resolveComponentCommon(commons ...v2.Common) ComponentCommon {
 	var backend Backend
 
 	if *backendConf.Kind == "s3" {
+		var roleArn *string
+		if backendConf.Role != nil {
+			// we know from our validations that if role is set, then account id must also be set
+			tmp := fmt.Sprintf("arn:aws:iam::%s:role/%s", *backendConf.AccountID, *backendConf.Role)
+			roleArn = &tmp
+		}
 		backend = Backend{
 			Kind: BackendKindS3,
 			S3: &S3Backend{
 				Region:  *backendConf.Region,
-				Profile: *backendConf.Profile,
+				Profile: backendConf.Profile,
 				Bucket:  *backendConf.Bucket,
+				RoleArn: roleArn,
 
 				AccountID:   backendConf.AccountID,
 				DynamoTable: backendConf.DynamoTable,
diff --git a/templates/account/Makefile.tmpl b/templates/account/Makefile.tmpl
index 899a1b2f..7771c873 100644
--- a/templates/account/Makefile.tmpl
+++ b/templates/account/Makefile.tmpl
@@ -1,18 +1,3 @@
-# Auto-generated by fogg. Do not edit
-# Make improvements in fogg, so that everyone can benefit.
-
-export TERRAFORM_VERSION := {{ .TerraformVersion }}
-export TFLINT_ENABLED := {{ if .TfLint.Enabled }}1{{ else }}0{{ end }}
-export TF_PLUGIN_CACHE_DIR := {{ .PathToRepoRoot }}/.terraform.d/plugin-cache
-export TF_BACKEND_KIND := {{ .Backend.Kind }}
-{{ if eq .Backend.Kind "s3" }}export AWS_BACKEND_PROFILE := {{ .Backend.S3.Profile }}{{ end }}
-{{ if .Providers.AWS }}{{ if .Providers.AWS.Profile }}
-export AWS_PROVIDER_PROFILE := {{ .Providers.AWS.Profile }}
-{{ end }}{{ end }}
-{{if .Providers.Heroku}}
-export HEROKU_PROVIDER := 1
-{{end}}
-
-include {{ .PathToRepoRoot }}/scripts/component.mk
-
-{{ template "make_help"  }}
+{{ template "fogg_header" }}
+{{ template "make_vars" . }}
+{{ template "make_help" }}
diff --git a/templates/common/aws_provider.tmpl b/templates/common/aws_provider.tmpl
index 2a873a28..0e0dcfb5 100644
--- a/templates/common/aws_provider.tmpl
+++ b/templates/common/aws_provider.tmpl
@@ -4,9 +4,9 @@ provider aws {
   version = "~> {{ .Version }}"
   region = "{{ .Region }}"
   {{ if .Profile }} profile = "{{ .Profile }}"{{ end }}
-  {{ if .Role }}
+  {{ if .RoleArn }}
   assume_role {
-    role_arn     = "arn:aws:iam::{{ .AccountID }}:role/{{ .Role }}"
+    role_arn     = "{{ .RoleArn }}"
   }
   {{ end }}
   allowed_account_ids = [{{ .AccountID }}]
diff --git a/templates/common/backends.tmpl b/templates/common/backends.tmpl
index 589f1686..114c1427 100644
--- a/templates/common/backends.tmpl
+++ b/templates/common/backends.tmpl
@@ -6,7 +6,8 @@
     key            = "{{ .S3.KeyPath }}"
     encrypt = true
     region = "{{ .S3.Region }}"
-    profile = "{{ .S3.Profile }}"
+    {{if .S3.Profile}}profile = "{{ .S3.Profile }}"{{end }}
+    {{if .S3.RoleArn}}role_arn = "{{ .S3.RoleArn }}"{{end }}
   {{ else if eq .Kind "remote" }}
     hostname = "{{ .Remote.HostName }}"
     organization = "{{ .Remote.Organization }}"
@@ -23,7 +24,8 @@
     {{ if .S3.DynamoTable }}dynamodb_table = "{{ .S3.DynamoTable }}"{{ end }}
     key            = "{{ .S3.KeyPath }}"
     region = "{{ .S3.Region }}"
-    profile = "{{ .S3.Profile }}"
+    {{if .S3.Profile}}profile = "{{ .S3.Profile }}"{{end }}
+    {{if .S3.RoleArn}}role_arn = "{{ .S3.RoleArn }}"{{end }}
   {{ else if eq .Kind "remote" }}
     hostname = "{{ .Remote.HostName }}"
     organization = "{{ .Remote.Organization }}"
diff --git a/templates/common/fogg_header.tmpl b/templates/common/fogg_header.tmpl
index 9715148e..d402ce13 100644
--- a/templates/common/fogg_header.tmpl
+++ b/templates/common/fogg_header.tmpl
@@ -1,4 +1,3 @@
-{{define "fogg_header"}}
-# Auto-generated by fogg. Do not edit
+{{define "fogg_header"}}# Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
-{{ end }}
\ No newline at end of file
+{{ end }}
diff --git a/templates/common/make_vars.tmpl b/templates/common/make_vars.tmpl
new file mode 100644
index 00000000..5ddbcc02
--- /dev/null
+++ b/templates/common/make_vars.tmpl
@@ -0,0 +1,13 @@
+{{ define "make_vars" }}
+export TERRAFORM_VERSION := {{ .TerraformVersion }}
+export TFLINT_ENABLED := {{ if .TfLint.Enabled }}1{{ else }}0{{ end }}
+export TF_PLUGIN_CACHE_DIR := {{ .PathToRepoRoot }}/.terraform.d/plugin-cache
+export TF_BACKEND_KIND := {{ .Backend.Kind }}
+{{ if .Backend.S3 }}{{ if .Backend.S3.Profile}}export AWS_BACKEND_PROFILE := {{ .Backend.S3.Profile }}{{ end }}{{end}}
+{{ if .Backend.S3 }}{{ if .Backend.S3.RoleArn }}export AWS_BACKEND_ROLE_ARN := {{ .Backend.S3.RoleArn }}{{ end }}{{end}}
+{{ if .Providers.AWS }}{{ if .Providers.AWS.Profile }}export AWS_PROVIDER_PROFILE := {{ .Providers.AWS.Profile }}{{ end }}{{ end }}
+{{ if .Providers.AWS }}{{ if .Providers.AWS.RoleArn }}export AWS_PROVIDER_ROLE_ARN := {{ .Providers.AWS.RoleArn }}{{ end }}{{ end }}
+{{if .Providers.Heroku}}export HEROKU_PROVIDER := 1{{end}}
+
+include {{ .PathToRepoRoot }}/scripts/component.mk
+{{ end }}
diff --git a/templates/component/terraform/Makefile.tmpl b/templates/component/terraform/Makefile.tmpl
index 899a1b2f..7771c873 100644
--- a/templates/component/terraform/Makefile.tmpl
+++ b/templates/component/terraform/Makefile.tmpl
@@ -1,18 +1,3 @@
-# Auto-generated by fogg. Do not edit
-# Make improvements in fogg, so that everyone can benefit.
-
-export TERRAFORM_VERSION := {{ .TerraformVersion }}
-export TFLINT_ENABLED := {{ if .TfLint.Enabled }}1{{ else }}0{{ end }}
-export TF_PLUGIN_CACHE_DIR := {{ .PathToRepoRoot }}/.terraform.d/plugin-cache
-export TF_BACKEND_KIND := {{ .Backend.Kind }}
-{{ if eq .Backend.Kind "s3" }}export AWS_BACKEND_PROFILE := {{ .Backend.S3.Profile }}{{ end }}
-{{ if .Providers.AWS }}{{ if .Providers.AWS.Profile }}
-export AWS_PROVIDER_PROFILE := {{ .Providers.AWS.Profile }}
-{{ end }}{{ end }}
-{{if .Providers.Heroku}}
-export HEROKU_PROVIDER := 1
-{{end}}
-
-include {{ .PathToRepoRoot }}/scripts/component.mk
-
-{{ template "make_help"  }}
+{{ template "fogg_header" }}
+{{ template "make_vars" . }}
+{{ template "make_help" }}
diff --git a/templates/global/Makefile.tmpl b/templates/global/Makefile.tmpl
index 899a1b2f..7771c873 100644
--- a/templates/global/Makefile.tmpl
+++ b/templates/global/Makefile.tmpl
@@ -1,18 +1,3 @@
-# Auto-generated by fogg. Do not edit
-# Make improvements in fogg, so that everyone can benefit.
-
-export TERRAFORM_VERSION := {{ .TerraformVersion }}
-export TFLINT_ENABLED := {{ if .TfLint.Enabled }}1{{ else }}0{{ end }}
-export TF_PLUGIN_CACHE_DIR := {{ .PathToRepoRoot }}/.terraform.d/plugin-cache
-export TF_BACKEND_KIND := {{ .Backend.Kind }}
-{{ if eq .Backend.Kind "s3" }}export AWS_BACKEND_PROFILE := {{ .Backend.S3.Profile }}{{ end }}
-{{ if .Providers.AWS }}{{ if .Providers.AWS.Profile }}
-export AWS_PROVIDER_PROFILE := {{ .Providers.AWS.Profile }}
-{{ end }}{{ end }}
-{{if .Providers.Heroku}}
-export HEROKU_PROVIDER := 1
-{{end}}
-
-include {{ .PathToRepoRoot }}/scripts/component.mk
-
-{{ template "make_help"  }}
+{{ template "fogg_header" }}
+{{ template "make_vars" . }}
+{{ template "make_help" }}
diff --git a/templates/repo/scripts/component.mk b/templates/repo/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/templates/repo/scripts/component.mk
+++ b/templates/repo/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:


Test patch:
diff --git a/testdata/bless_provider_yaml/.terraformignore b/testdata/bless_provider_yaml/.terraformignore
index 2ff6e88a..1402663d 100644
--- a/testdata/bless_provider_yaml/.terraformignore
+++ b/testdata/bless_provider_yaml/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/bless_provider_yaml/scripts/component.mk b/testdata/bless_provider_yaml/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/bless_provider_yaml/scripts/component.mk
+++ b/testdata/bless_provider_yaml/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/bless_provider_yaml/terraform/accounts/foo/Makefile b/testdata/bless_provider_yaml/terraform/accounts/foo/Makefile
index 57369ee3..70ec2d6f 100644
--- a/testdata/bless_provider_yaml/terraform/accounts/foo/Makefile
+++ b/testdata/bless_provider_yaml/terraform/accounts/foo/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foofoo
 
 
 
+
+
 include ../../..//scripts/component.mk
 
 
diff --git a/testdata/bless_provider_yaml/terraform/accounts/foo/fogg.tf b/testdata/bless_provider_yaml/terraform/accounts/foo/fogg.tf
index 8254c87f..f5b61068 100644
--- a/testdata/bless_provider_yaml/terraform/accounts/foo/fogg.tf
+++ b/testdata/bless_provider_yaml/terraform/accounts/foo/fogg.tf
@@ -29,6 +29,7 @@ terraform {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 variable project {
@@ -59,6 +60,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 provider random {
diff --git a/testdata/bless_provider_yaml/terraform/envs/bar/bam/Makefile b/testdata/bless_provider_yaml/terraform/envs/bar/bam/Makefile
index c0665191..8dad7ed7 100644
--- a/testdata/bless_provider_yaml/terraform/envs/bar/bam/Makefile
+++ b/testdata/bless_provider_yaml/terraform/envs/bar/bam/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foofoo
 
 
 
+
+
 include ../../../..//scripts/component.mk
 
 
diff --git a/testdata/bless_provider_yaml/terraform/envs/bar/bam/fogg.tf b/testdata/bless_provider_yaml/terraform/envs/bar/bam/fogg.tf
index b6912828..0f361de1 100644
--- a/testdata/bless_provider_yaml/terraform/envs/bar/bam/fogg.tf
+++ b/testdata/bless_provider_yaml/terraform/envs/bar/bam/fogg.tf
@@ -30,6 +30,7 @@ terraform {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 variable env {
@@ -69,6 +70,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 # remote state for accounts
@@ -83,6 +85,7 @@ data terraform_remote_state foo {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/bless_provider_yaml/terraform/global/Makefile b/testdata/bless_provider_yaml/terraform/global/Makefile
index 8db849b4..541f80c9 100644
--- a/testdata/bless_provider_yaml/terraform/global/Makefile
+++ b/testdata/bless_provider_yaml/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foofoo
 
 
 
+
+
 include ../..//scripts/component.mk
 
 
diff --git a/testdata/bless_provider_yaml/terraform/global/fogg.tf b/testdata/bless_provider_yaml/terraform/global/fogg.tf
index 28000f22..3e3b46da 100644
--- a/testdata/bless_provider_yaml/terraform/global/fogg.tf
+++ b/testdata/bless_provider_yaml/terraform/global/fogg.tf
@@ -30,6 +30,7 @@ terraform {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 variable env {
diff --git a/testdata/circleci/.terraformignore b/testdata/circleci/.terraformignore
index d4a2b078..cb811c70 100644
--- a/testdata/circleci/.terraformignore
+++ b/testdata/circleci/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/circleci/scripts/component.mk b/testdata/circleci/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/circleci/scripts/component.mk
+++ b/testdata/circleci/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/circleci/terraform/global/Makefile b/testdata/circleci/terraform/global/Makefile
index 832cb409..cf65e9f6 100644
--- a/testdata/circleci/terraform/global/Makefile
+++ b/testdata/circleci/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../..//scripts/component.mk
 
 
diff --git a/testdata/circleci/terraform/global/fogg.tf b/testdata/circleci/terraform/global/fogg.tf
index 7138209c..a3e0ba5b 100644
--- a/testdata/circleci/terraform/global/fogg.tf
+++ b/testdata/circleci/terraform/global/fogg.tf
@@ -12,6 +12,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable env {
diff --git a/testdata/github_actions/.terraformignore b/testdata/github_actions/.terraformignore
index d4a2b078..cb811c70 100644
--- a/testdata/github_actions/.terraformignore
+++ b/testdata/github_actions/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/github_actions/scripts/component.mk b/testdata/github_actions/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/github_actions/scripts/component.mk
+++ b/testdata/github_actions/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/github_actions/terraform/global/Makefile b/testdata/github_actions/terraform/global/Makefile
index 832cb409..cf65e9f6 100644
--- a/testdata/github_actions/terraform/global/Makefile
+++ b/testdata/github_actions/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../..//scripts/component.mk
 
 
diff --git a/testdata/github_actions/terraform/global/fogg.tf b/testdata/github_actions/terraform/global/fogg.tf
index 7138209c..a3e0ba5b 100644
--- a/testdata/github_actions/terraform/global/fogg.tf
+++ b/testdata/github_actions/terraform/global/fogg.tf
@@ -12,6 +12,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable env {
diff --git a/testdata/github_provider_yaml/.terraformignore b/testdata/github_provider_yaml/.terraformignore
index 2ff6e88a..1402663d 100644
--- a/testdata/github_provider_yaml/.terraformignore
+++ b/testdata/github_provider_yaml/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/github_provider_yaml/scripts/component.mk b/testdata/github_provider_yaml/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/github_provider_yaml/scripts/component.mk
+++ b/testdata/github_provider_yaml/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/github_provider_yaml/terraform/accounts/foo/Makefile b/testdata/github_provider_yaml/terraform/accounts/foo/Makefile
index 1834eb54..cb568e27 100644
--- a/testdata/github_provider_yaml/terraform/accounts/foo/Makefile
+++ b/testdata/github_provider_yaml/terraform/accounts/foo/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../../..//scripts/component.mk
 
 
diff --git a/testdata/github_provider_yaml/terraform/accounts/foo/fogg.tf b/testdata/github_provider_yaml/terraform/accounts/foo/fogg.tf
index 09af0def..98f696cf 100644
--- a/testdata/github_provider_yaml/terraform/accounts/foo/fogg.tf
+++ b/testdata/github_provider_yaml/terraform/accounts/foo/fogg.tf
@@ -16,6 +16,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable project {
@@ -46,6 +47,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 provider random {
diff --git a/testdata/github_provider_yaml/terraform/envs/bar/bam/Makefile b/testdata/github_provider_yaml/terraform/envs/bar/bam/Makefile
index 40ff49de..43c9b4de 100644
--- a/testdata/github_provider_yaml/terraform/envs/bar/bam/Makefile
+++ b/testdata/github_provider_yaml/terraform/envs/bar/bam/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../../../..//scripts/component.mk
 
 
diff --git a/testdata/github_provider_yaml/terraform/envs/bar/bam/fogg.tf b/testdata/github_provider_yaml/terraform/envs/bar/bam/fogg.tf
index ae6c15a9..63a94344 100644
--- a/testdata/github_provider_yaml/terraform/envs/bar/bam/fogg.tf
+++ b/testdata/github_provider_yaml/terraform/envs/bar/bam/fogg.tf
@@ -17,6 +17,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable env {
@@ -56,6 +57,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 # remote state for accounts
@@ -70,6 +72,7 @@ data terraform_remote_state foo {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/github_provider_yaml/terraform/global/Makefile b/testdata/github_provider_yaml/terraform/global/Makefile
index 832cb409..cf65e9f6 100644
--- a/testdata/github_provider_yaml/terraform/global/Makefile
+++ b/testdata/github_provider_yaml/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../..//scripts/component.mk
 
 
diff --git a/testdata/github_provider_yaml/terraform/global/fogg.tf b/testdata/github_provider_yaml/terraform/global/fogg.tf
index c08e586a..bcad3c24 100644
--- a/testdata/github_provider_yaml/terraform/global/fogg.tf
+++ b/testdata/github_provider_yaml/terraform/global/fogg.tf
@@ -17,6 +17,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable env {
diff --git a/testdata/okta_provider_yaml/.terraformignore b/testdata/okta_provider_yaml/.terraformignore
index 2ff6e88a..1402663d 100644
--- a/testdata/okta_provider_yaml/.terraformignore
+++ b/testdata/okta_provider_yaml/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/okta_provider_yaml/scripts/component.mk b/testdata/okta_provider_yaml/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/okta_provider_yaml/scripts/component.mk
+++ b/testdata/okta_provider_yaml/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/okta_provider_yaml/terraform/accounts/foo/Makefile b/testdata/okta_provider_yaml/terraform/accounts/foo/Makefile
index 57369ee3..70ec2d6f 100644
--- a/testdata/okta_provider_yaml/terraform/accounts/foo/Makefile
+++ b/testdata/okta_provider_yaml/terraform/accounts/foo/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foofoo
 
 
 
+
+
 include ../../..//scripts/component.mk
 
 
diff --git a/testdata/okta_provider_yaml/terraform/accounts/foo/fogg.tf b/testdata/okta_provider_yaml/terraform/accounts/foo/fogg.tf
index 91d7a92e..2bc7676d 100644
--- a/testdata/okta_provider_yaml/terraform/accounts/foo/fogg.tf
+++ b/testdata/okta_provider_yaml/terraform/accounts/foo/fogg.tf
@@ -17,6 +17,7 @@ terraform {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 variable project {
@@ -47,6 +48,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 provider random {
diff --git a/testdata/okta_provider_yaml/terraform/envs/bar/bam/Makefile b/testdata/okta_provider_yaml/terraform/envs/bar/bam/Makefile
index c0665191..8dad7ed7 100644
--- a/testdata/okta_provider_yaml/terraform/envs/bar/bam/Makefile
+++ b/testdata/okta_provider_yaml/terraform/envs/bar/bam/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foofoo
 
 
 
+
+
 include ../../../..//scripts/component.mk
 
 
diff --git a/testdata/okta_provider_yaml/terraform/envs/bar/bam/fogg.tf b/testdata/okta_provider_yaml/terraform/envs/bar/bam/fogg.tf
index d506787f..d7f64f90 100644
--- a/testdata/okta_provider_yaml/terraform/envs/bar/bam/fogg.tf
+++ b/testdata/okta_provider_yaml/terraform/envs/bar/bam/fogg.tf
@@ -18,6 +18,7 @@ terraform {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 variable env {
@@ -57,6 +58,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 # remote state for accounts
@@ -71,6 +73,7 @@ data terraform_remote_state foo {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/okta_provider_yaml/terraform/global/Makefile b/testdata/okta_provider_yaml/terraform/global/Makefile
index 8db849b4..541f80c9 100644
--- a/testdata/okta_provider_yaml/terraform/global/Makefile
+++ b/testdata/okta_provider_yaml/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foofoo
 
 
 
+
+
 include ../..//scripts/component.mk
 
 
diff --git a/testdata/okta_provider_yaml/terraform/global/fogg.tf b/testdata/okta_provider_yaml/terraform/global/fogg.tf
index 860fdb8f..2ac5f3c3 100644
--- a/testdata/okta_provider_yaml/terraform/global/fogg.tf
+++ b/testdata/okta_provider_yaml/terraform/global/fogg.tf
@@ -18,6 +18,7 @@ terraform {
     region  = "region"
     profile = "foofoo"
 
+
   }
 }
 variable env {
diff --git a/testdata/snowflake_provider_yaml/.terraformignore b/testdata/snowflake_provider_yaml/.terraformignore
index 2ff6e88a..1402663d 100644
--- a/testdata/snowflake_provider_yaml/.terraformignore
+++ b/testdata/snowflake_provider_yaml/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/snowflake_provider_yaml/scripts/component.mk b/testdata/snowflake_provider_yaml/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/snowflake_provider_yaml/scripts/component.mk
+++ b/testdata/snowflake_provider_yaml/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/snowflake_provider_yaml/terraform/accounts/foo/Makefile b/testdata/snowflake_provider_yaml/terraform/accounts/foo/Makefile
index 1834eb54..cb568e27 100644
--- a/testdata/snowflake_provider_yaml/terraform/accounts/foo/Makefile
+++ b/testdata/snowflake_provider_yaml/terraform/accounts/foo/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../../..//scripts/component.mk
 
 
diff --git a/testdata/snowflake_provider_yaml/terraform/accounts/foo/fogg.tf b/testdata/snowflake_provider_yaml/terraform/accounts/foo/fogg.tf
index 1b045a02..fb47fdb6 100644
--- a/testdata/snowflake_provider_yaml/terraform/accounts/foo/fogg.tf
+++ b/testdata/snowflake_provider_yaml/terraform/accounts/foo/fogg.tf
@@ -17,6 +17,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable project {
@@ -47,6 +48,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 provider random {
diff --git a/testdata/snowflake_provider_yaml/terraform/envs/bar/bam/Makefile b/testdata/snowflake_provider_yaml/terraform/envs/bar/bam/Makefile
index 40ff49de..43c9b4de 100644
--- a/testdata/snowflake_provider_yaml/terraform/envs/bar/bam/Makefile
+++ b/testdata/snowflake_provider_yaml/terraform/envs/bar/bam/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../../../..//scripts/component.mk
 
 
diff --git a/testdata/snowflake_provider_yaml/terraform/envs/bar/bam/fogg.tf b/testdata/snowflake_provider_yaml/terraform/envs/bar/bam/fogg.tf
index 536e92a8..eb1056b1 100644
--- a/testdata/snowflake_provider_yaml/terraform/envs/bar/bam/fogg.tf
+++ b/testdata/snowflake_provider_yaml/terraform/envs/bar/bam/fogg.tf
@@ -18,6 +18,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable env {
@@ -57,6 +58,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 # remote state for accounts
@@ -71,6 +73,7 @@ data terraform_remote_state foo {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/snowflake_provider_yaml/terraform/global/Makefile b/testdata/snowflake_provider_yaml/terraform/global/Makefile
index 832cb409..cf65e9f6 100644
--- a/testdata/snowflake_provider_yaml/terraform/global/Makefile
+++ b/testdata/snowflake_provider_yaml/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../..//scripts/component.mk
 
 
diff --git a/testdata/snowflake_provider_yaml/terraform/global/fogg.tf b/testdata/snowflake_provider_yaml/terraform/global/fogg.tf
index ca299e0f..de8ade24 100644
--- a/testdata/snowflake_provider_yaml/terraform/global/fogg.tf
+++ b/testdata/snowflake_provider_yaml/terraform/global/fogg.tf
@@ -18,6 +18,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable env {
diff --git a/testdata/tfe_provider_yaml/.terraformignore b/testdata/tfe_provider_yaml/.terraformignore
index 2ff6e88a..1402663d 100644
--- a/testdata/tfe_provider_yaml/.terraformignore
+++ b/testdata/tfe_provider_yaml/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/tfe_provider_yaml/scripts/component.mk b/testdata/tfe_provider_yaml/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/tfe_provider_yaml/scripts/component.mk
+++ b/testdata/tfe_provider_yaml/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/tfe_provider_yaml/terraform/accounts/foo/Makefile b/testdata/tfe_provider_yaml/terraform/accounts/foo/Makefile
index 1834eb54..cb568e27 100644
--- a/testdata/tfe_provider_yaml/terraform/accounts/foo/Makefile
+++ b/testdata/tfe_provider_yaml/terraform/accounts/foo/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../../..//scripts/component.mk
 
 
diff --git a/testdata/tfe_provider_yaml/terraform/accounts/foo/fogg.tf b/testdata/tfe_provider_yaml/terraform/accounts/foo/fogg.tf
index c5a72ab9..00e0f675 100644
--- a/testdata/tfe_provider_yaml/terraform/accounts/foo/fogg.tf
+++ b/testdata/tfe_provider_yaml/terraform/accounts/foo/fogg.tf
@@ -15,6 +15,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable project {
@@ -45,6 +46,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 provider random {
diff --git a/testdata/tfe_provider_yaml/terraform/envs/bar/bam/Makefile b/testdata/tfe_provider_yaml/terraform/envs/bar/bam/Makefile
index 40ff49de..43c9b4de 100644
--- a/testdata/tfe_provider_yaml/terraform/envs/bar/bam/Makefile
+++ b/testdata/tfe_provider_yaml/terraform/envs/bar/bam/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../../../..//scripts/component.mk
 
 
diff --git a/testdata/tfe_provider_yaml/terraform/envs/bar/bam/fogg.tf b/testdata/tfe_provider_yaml/terraform/envs/bar/bam/fogg.tf
index 7f5193ef..be432107 100644
--- a/testdata/tfe_provider_yaml/terraform/envs/bar/bam/fogg.tf
+++ b/testdata/tfe_provider_yaml/terraform/envs/bar/bam/fogg.tf
@@ -12,6 +12,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable env {
@@ -51,6 +52,7 @@ data terraform_remote_state global {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 # remote state for accounts
@@ -65,6 +67,7 @@ data terraform_remote_state foo {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/tfe_provider_yaml/terraform/global/Makefile b/testdata/tfe_provider_yaml/terraform/global/Makefile
index 832cb409..cf65e9f6 100644
--- a/testdata/tfe_provider_yaml/terraform/global/Makefile
+++ b/testdata/tfe_provider_yaml/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../..//scripts/component.mk
 
 
diff --git a/testdata/tfe_provider_yaml/terraform/global/fogg.tf b/testdata/tfe_provider_yaml/terraform/global/fogg.tf
index f9d49a61..86958733 100644
--- a/testdata/tfe_provider_yaml/terraform/global/fogg.tf
+++ b/testdata/tfe_provider_yaml/terraform/global/fogg.tf
@@ -16,6 +16,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable env {
diff --git a/testdata/v2_full_yaml/.terraformignore b/testdata/v2_full_yaml/.terraformignore
index f7a0a5d8..5f2f70e4 100644
--- a/testdata/v2_full_yaml/.terraformignore
+++ b/testdata/v2_full_yaml/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/v2_full_yaml/fogg.yml b/testdata/v2_full_yaml/fogg.yml
index 7b9b96d3..5c2d3298 100644
--- a/testdata/v2_full_yaml/fogg.yml
+++ b/testdata/v2_full_yaml/fogg.yml
@@ -11,6 +11,7 @@ accounts:
     providers:
       aws:
         account_id: 123
+        role: roll
 defaults:
   backend:
     bucket: buck
diff --git a/testdata/v2_full_yaml/scripts/component.mk b/testdata/v2_full_yaml/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/v2_full_yaml/scripts/component.mk
+++ b/testdata/v2_full_yaml/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/v2_full_yaml/terraform/accounts/bar/Makefile b/testdata/v2_full_yaml/terraform/accounts/bar/Makefile
index f87b42b8..450b8264 100644
--- a/testdata/v2_full_yaml/terraform/accounts/bar/Makefile
+++ b/testdata/v2_full_yaml/terraform/accounts/bar/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../..//.terraform.d/plugin-cache
@@ -8,6 +9,8 @@ export TF_BACKEND_KIND := s3
 export AWS_BACKEND_PROFILE := profile
 
 
+export AWS_PROVIDER_ROLE_ARN := arn:aws:iam::456:role/foo
+
 
 include ../../..//scripts/component.mk
 
diff --git a/testdata/v2_full_yaml/terraform/accounts/bar/fogg.tf b/testdata/v2_full_yaml/terraform/accounts/bar/fogg.tf
index 9d1ca902..337eb881 100644
--- a/testdata/v2_full_yaml/terraform/accounts/bar/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/accounts/bar/fogg.tf
@@ -22,7 +22,7 @@ provider aws {
 
 
   assume_role {
-    role_arn = "arn:aws:iam::456:role/foo"
+    role_arn = "foo"
   }
 
   allowed_account_ids = [456]
@@ -36,7 +36,7 @@ provider aws {
 
 
   assume_role {
-    role_arn = "arn:aws:iam::456:role/foo"
+    role_arn = "foo"
   }
 
   allowed_account_ids = [456]
@@ -53,6 +53,7 @@ terraform {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 variable project {
@@ -97,6 +98,7 @@ data terraform_remote_state global {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state foo {
@@ -110,6 +112,7 @@ data terraform_remote_state foo {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 provider random {
diff --git a/testdata/v2_full_yaml/terraform/accounts/foo/Makefile b/testdata/v2_full_yaml/terraform/accounts/foo/Makefile
index e98b5e2c..35bd9cf0 100644
--- a/testdata/v2_full_yaml/terraform/accounts/foo/Makefile
+++ b/testdata/v2_full_yaml/terraform/accounts/foo/Makefile
@@ -1,14 +1,15 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../..//.terraform.d/plugin-cache
 export TF_BACKEND_KIND := s3
 export AWS_BACKEND_PROFILE := profile
 
-export AWS_PROVIDER_PROFILE := profile
 
+export AWS_PROVIDER_ROLE_ARN := arn:aws:iam::123:role/roll
 
 
 include ../../..//scripts/component.mk
diff --git a/testdata/v2_full_yaml/terraform/accounts/foo/fogg.tf b/testdata/v2_full_yaml/terraform/accounts/foo/fogg.tf
index 2b914eba..186cab59 100644
--- a/testdata/v2_full_yaml/terraform/accounts/foo/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/accounts/foo/fogg.tf
@@ -4,7 +4,11 @@ provider aws {
 
   version = "~> 0.12.0"
   region  = "us-west-2"
-  profile = "profile"
+
+
+  assume_role {
+    role_arn = "arn:aws:iam::123:role/roll"
+  }
 
   allowed_account_ids = [123]
 }
@@ -21,6 +25,7 @@ terraform {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 variable project {
@@ -31,10 +36,6 @@ variable region {
   type    = string
   default = "us-west-2"
 }
-variable aws_profile {
-  type    = string
-  default = "profile"
-}
 variable owner {
   type    = string
   default = "foo@example.com"
@@ -69,6 +70,7 @@ data terraform_remote_state global {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state bar {
@@ -82,6 +84,7 @@ data terraform_remote_state bar {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 provider random {
diff --git a/testdata/v2_full_yaml/terraform/envs/prod/datadog/Makefile b/testdata/v2_full_yaml/terraform/envs/prod/datadog/Makefile
index 4a8d1eee..40858100 100644
--- a/testdata/v2_full_yaml/terraform/envs/prod/datadog/Makefile
+++ b/testdata/v2_full_yaml/terraform/envs/prod/datadog/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
diff --git a/testdata/v2_full_yaml/terraform/envs/prod/datadog/fogg.tf b/testdata/v2_full_yaml/terraform/envs/prod/datadog/fogg.tf
index 57f98cfe..35ea7002 100644
--- a/testdata/v2_full_yaml/terraform/envs/prod/datadog/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/prod/datadog/fogg.tf
@@ -25,6 +25,7 @@ terraform {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 variable env {
@@ -76,6 +77,7 @@ data terraform_remote_state global {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state hero {
@@ -89,6 +91,7 @@ data terraform_remote_state hero {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # remote state for accounts
@@ -103,6 +106,7 @@ data terraform_remote_state bar {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state foo {
@@ -116,6 +120,7 @@ data terraform_remote_state foo {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/v2_full_yaml/terraform/envs/prod/hero/Makefile b/testdata/v2_full_yaml/terraform/envs/prod/hero/Makefile
index 77bb069b..33ead7da 100644
--- a/testdata/v2_full_yaml/terraform/envs/prod/hero/Makefile
+++ b/testdata/v2_full_yaml/terraform/envs/prod/hero/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
@@ -9,10 +10,8 @@ export AWS_BACKEND_PROFILE := profile
 
 export AWS_PROVIDER_PROFILE := profile
 
-
 export HEROKU_PROVIDER := 1
 
-
 include ../../../..//scripts/component.mk
 
 
diff --git a/testdata/v2_full_yaml/terraform/envs/prod/hero/fogg.tf b/testdata/v2_full_yaml/terraform/envs/prod/hero/fogg.tf
index 56391748..90d5691b 100644
--- a/testdata/v2_full_yaml/terraform/envs/prod/hero/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/prod/hero/fogg.tf
@@ -25,6 +25,7 @@ terraform {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 variable env {
@@ -76,6 +77,7 @@ data terraform_remote_state global {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state datadog {
@@ -89,6 +91,7 @@ data terraform_remote_state datadog {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # remote state for accounts
@@ -103,6 +106,7 @@ data terraform_remote_state bar {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state foo {
@@ -116,6 +120,7 @@ data terraform_remote_state foo {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/v2_full_yaml/terraform/envs/staging/comp1/Makefile b/testdata/v2_full_yaml/terraform/envs/staging/comp1/Makefile
index fcc94951..5d6026aa 100644
--- a/testdata/v2_full_yaml/terraform/envs/staging/comp1/Makefile
+++ b/testdata/v2_full_yaml/terraform/envs/staging/comp1/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
diff --git a/testdata/v2_full_yaml/terraform/envs/staging/comp1/fogg.tf b/testdata/v2_full_yaml/terraform/envs/staging/comp1/fogg.tf
index 680c21b8..16949b04 100644
--- a/testdata/v2_full_yaml/terraform/envs/staging/comp1/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/staging/comp1/fogg.tf
@@ -22,6 +22,7 @@ terraform {
     region  = "us-west-2"
     profile = "comp1"
 
+
   }
 }
 variable env {
@@ -73,6 +74,7 @@ data terraform_remote_state global {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state comp2 {
@@ -86,6 +88,7 @@ data terraform_remote_state comp2 {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state vpc {
@@ -99,6 +102,7 @@ data terraform_remote_state vpc {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # remote state for accounts
@@ -113,6 +117,7 @@ data terraform_remote_state bar {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state foo {
@@ -126,6 +131,7 @@ data terraform_remote_state foo {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/v2_full_yaml/terraform/envs/staging/comp2/Makefile b/testdata/v2_full_yaml/terraform/envs/staging/comp2/Makefile
index 4a8d1eee..40858100 100644
--- a/testdata/v2_full_yaml/terraform/envs/staging/comp2/Makefile
+++ b/testdata/v2_full_yaml/terraform/envs/staging/comp2/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
diff --git a/testdata/v2_full_yaml/terraform/envs/staging/comp2/fogg.tf b/testdata/v2_full_yaml/terraform/envs/staging/comp2/fogg.tf
index 6010031f..b2bb9d74 100644
--- a/testdata/v2_full_yaml/terraform/envs/staging/comp2/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/staging/comp2/fogg.tf
@@ -22,6 +22,7 @@ terraform {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 variable env {
@@ -73,6 +74,7 @@ data terraform_remote_state global {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state comp1 {
@@ -86,6 +88,7 @@ data terraform_remote_state comp1 {
     region  = "us-west-2"
     profile = "comp1"
 
+
   }
 }
 data terraform_remote_state vpc {
@@ -99,6 +102,7 @@ data terraform_remote_state vpc {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # remote state for accounts
@@ -113,6 +117,7 @@ data terraform_remote_state bar {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state foo {
@@ -126,6 +131,7 @@ data terraform_remote_state foo {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/v2_full_yaml/terraform/envs/staging/vpc/Makefile b/testdata/v2_full_yaml/terraform/envs/staging/vpc/Makefile
index 4a8d1eee..40858100 100644
--- a/testdata/v2_full_yaml/terraform/envs/staging/vpc/Makefile
+++ b/testdata/v2_full_yaml/terraform/envs/staging/vpc/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
diff --git a/testdata/v2_full_yaml/terraform/envs/staging/vpc/fogg.tf b/testdata/v2_full_yaml/terraform/envs/staging/vpc/fogg.tf
index 57771d06..0b052879 100644
--- a/testdata/v2_full_yaml/terraform/envs/staging/vpc/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/envs/staging/vpc/fogg.tf
@@ -22,6 +22,7 @@ terraform {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 variable env {
@@ -73,6 +74,7 @@ data terraform_remote_state global {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state comp1 {
@@ -86,6 +88,7 @@ data terraform_remote_state comp1 {
     region  = "us-west-2"
     profile = "comp1"
 
+
   }
 }
 data terraform_remote_state comp2 {
@@ -99,6 +102,7 @@ data terraform_remote_state comp2 {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # remote state for accounts
@@ -113,6 +117,7 @@ data terraform_remote_state bar {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 data terraform_remote_state foo {
@@ -126,6 +131,7 @@ data terraform_remote_state foo {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # map of aws_accounts
diff --git a/testdata/v2_full_yaml/terraform/global/Makefile b/testdata/v2_full_yaml/terraform/global/Makefile
index 203ff4cd..400f2ba5 100644
--- a/testdata/v2_full_yaml/terraform/global/Makefile
+++ b/testdata/v2_full_yaml/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
diff --git a/testdata/v2_full_yaml/terraform/global/fogg.tf b/testdata/v2_full_yaml/terraform/global/fogg.tf
index fe71a654..df7dead2 100644
--- a/testdata/v2_full_yaml/terraform/global/fogg.tf
+++ b/testdata/v2_full_yaml/terraform/global/fogg.tf
@@ -22,6 +22,7 @@ terraform {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 variable env {
diff --git a/testdata/v2_minimal_valid_yaml/.terraformignore b/testdata/v2_minimal_valid_yaml/.terraformignore
index d4a2b078..cb811c70 100644
--- a/testdata/v2_minimal_valid_yaml/.terraformignore
+++ b/testdata/v2_minimal_valid_yaml/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/v2_minimal_valid_yaml/scripts/component.mk b/testdata/v2_minimal_valid_yaml/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/v2_minimal_valid_yaml/scripts/component.mk
+++ b/testdata/v2_minimal_valid_yaml/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/v2_minimal_valid_yaml/terraform/global/Makefile b/testdata/v2_minimal_valid_yaml/terraform/global/Makefile
index 832cb409..cf65e9f6 100644
--- a/testdata/v2_minimal_valid_yaml/terraform/global/Makefile
+++ b/testdata/v2_minimal_valid_yaml/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 1.1.1
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := foo
 
 
 
+
+
 include ../..//scripts/component.mk
 
 
diff --git a/testdata/v2_minimal_valid_yaml/terraform/global/fogg.tf b/testdata/v2_minimal_valid_yaml/terraform/global/fogg.tf
index 7138209c..a3e0ba5b 100644
--- a/testdata/v2_minimal_valid_yaml/terraform/global/fogg.tf
+++ b/testdata/v2_minimal_valid_yaml/terraform/global/fogg.tf
@@ -12,6 +12,7 @@ terraform {
     region  = "region"
     profile = "foo"
 
+
   }
 }
 variable env {
diff --git a/testdata/v2_no_aws_provider_yaml/.terraformignore b/testdata/v2_no_aws_provider_yaml/.terraformignore
index c626e4a1..b10c1cc4 100644
--- a/testdata/v2_no_aws_provider_yaml/.terraformignore
+++ b/testdata/v2_no_aws_provider_yaml/.terraformignore
@@ -1,4 +1,3 @@
-
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
diff --git a/testdata/v2_no_aws_provider_yaml/scripts/component.mk b/testdata/v2_no_aws_provider_yaml/scripts/component.mk
index d4e05673..99aa7b71 100644
--- a/testdata/v2_no_aws_provider_yaml/scripts/component.mk
+++ b/testdata/v2_no_aws_provider_yaml/scripts/component.mk
@@ -48,6 +48,9 @@ check-auth-aws:
 	@for p in $(AWS_BACKEND_PROFILE) $(AWS_PROVIDER_PROFILE); do \
 		aws --profile $$p sts get-caller-identity > /dev/null || (echo "AWS AUTH error. This component is configured to use a profile named '$$p'. Please add one to your ~/.aws/config" && exit -1); \
 	done
+	@for r in $(AWS_BACKEND_ROLE_ARN) $(AWS_PROVIDER_ROLE_ARN); do \
+		aws sts assume-role --role-arn $$r --role-session-name fogg-auth-test > /dev/null || (echo "AWS AUTH error. This component is configured to use a role named '$$r'." && exit -1); \
+	done
 .PHONY: check-auth-aws
 
 check-auth-heroku:
diff --git a/testdata/v2_no_aws_provider_yaml/terraform/envs/staging/vpc/Makefile b/testdata/v2_no_aws_provider_yaml/terraform/envs/staging/vpc/Makefile
index 3a7c96b4..e770aecc 100644
--- a/testdata/v2_no_aws_provider_yaml/terraform/envs/staging/vpc/Makefile
+++ b/testdata/v2_no_aws_provider_yaml/terraform/envs/staging/vpc/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../../../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := profile
 
 
 
+
+
 include ../../../..//scripts/component.mk
 
 
diff --git a/testdata/v2_no_aws_provider_yaml/terraform/envs/staging/vpc/fogg.tf b/testdata/v2_no_aws_provider_yaml/terraform/envs/staging/vpc/fogg.tf
index b74b2c55..11988c68 100644
--- a/testdata/v2_no_aws_provider_yaml/terraform/envs/staging/vpc/fogg.tf
+++ b/testdata/v2_no_aws_provider_yaml/terraform/envs/staging/vpc/fogg.tf
@@ -12,6 +12,7 @@ terraform {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 variable env {
@@ -55,6 +56,7 @@ data terraform_remote_state global {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 # remote state for accounts
diff --git a/testdata/v2_no_aws_provider_yaml/terraform/global/Makefile b/testdata/v2_no_aws_provider_yaml/terraform/global/Makefile
index ef8383f1..76b5e0b3 100644
--- a/testdata/v2_no_aws_provider_yaml/terraform/global/Makefile
+++ b/testdata/v2_no_aws_provider_yaml/terraform/global/Makefile
@@ -1,6 +1,7 @@
 # Auto-generated by fogg. Do not edit
 # Make improvements in fogg, so that everyone can benefit.
 
+
 export TERRAFORM_VERSION := 0.100.0
 export TFLINT_ENABLED := 0
 export TF_PLUGIN_CACHE_DIR := ../..//.terraform.d/plugin-cache
@@ -9,6 +10,8 @@ export AWS_BACKEND_PROFILE := profile
 
 
 
+
+
 include ../..//scripts/component.mk
 
 
diff --git a/testdata/v2_no_aws_provider_yaml/terraform/global/fogg.tf b/testdata/v2_no_aws_provider_yaml/terraform/global/fogg.tf
index a857ff2d..ef23a8c1 100644
--- a/testdata/v2_no_aws_provider_yaml/terraform/global/fogg.tf
+++ b/testdata/v2_no_aws_provider_yaml/terraform/global/fogg.tf
@@ -12,6 +12,7 @@ terraform {
     region  = "us-west-2"
     profile = "profile"
 
+
   }
 }
 variable env {