What should be in ~/.aws/config is found on this page: https://docs.cloudposse.com/geodesic/module/quickstart/ First have a Root account and create a user in iam who is assigned sts:AssumeRole • More info on that found here: https://aws.amazon.com/premiumsupport/knowledge-center/iam-assume-role-cli/ • In your secondary account (possibly staging) have a user with the a policy attached with access you wish for them to control in the secondary account • in IAM create a role and select “Another AWS Account” as the Trust Entity • Provide the Account ID of the Root account • do aws-vault add for your primary admin account, note for me this was not the user i created in the root account, but my primary admin user • build geodesic with the secondary account listed in the dockerfile under: • ENV AWS_DEFAULT_PROFILE • do all the make init, make docker/build and docker run commands from the quick start • once in geodesic do assume-role and things were working If anyone reviews this and finds i did something incorrectly please let me know. All the best.

@jla we were using aws-google-auth previosuly