Cross Account Role Chaining Mock Credentials in Python

import json

class CredentialChain:
    def __init__(self, account_id, role_name):
        self.account_id = account_id
        self.role_name = role_name
        self.credentials = {}

    def assume_role(self, session_name="mock_session"):
        """Simulate STS AssumeRole, returning mock credentials with expiry."""
        arn = f"arn:aws:iam::{self.account_id}:role/{self.role_name}"
        session_creds = {
            "AccessKeyId": f"ASIA{self.account_id[-4:]}{self.role_name[:4].upper()}",
            "SecretAccessKey": f"mock-secret-{self.account_id}-{self.role_name.lower()}",
            "SessionToken": f"MockToken{self.role_name.replace('-', '')}{session_name}",
            "Expiration": "2025-01-01T00:00:00Z",
            "RoleArn": arn
        }
        self.credentials = session_creds
        return session_creds

    def chain_role(self, target_account, target_role, session_name="chained_session"):
        """Chain: assume a role in another account using current credentials."""
        if not self.credentials:
            raise ValueError("No current credentials. Call assume_role first.")
        chained = self.assume_role(target_account, target_role)
        chained["ChainedFrom"] = f"{self.account_id}:{self.role_name}"
        chained["SessionName"] = session_name
        return chained

    def display(self):
        return json.dumps(self.credentials, indent=2)


if __name__ == "__main__":
    initial = CredentialChain("123456789012", "initial-role")
    print("=== Initial Credentials ===")
    print(initial.assume_role())
    print("\n=== Chained Credentials ===")
    print(initial.chain_role("210987654321", "target-role"))