AWS Extend Switch Roles for Managing IAM Role Profiles

Why AWS Extend Switch Roles Exists

The AWS Management Console stores a maximum of five recently used roles in its switch-role history. AWS Extend Switch Roles adds a manually configured menu of switchable roles, so administrators can keep a larger working set visible without repeatedly searching for account IDs and role names. The project targets people who regularly move among AWS accounts through IAM roles, particularly across an AWS Organizations structure or several related accounts.

The extension is available as a Chrome extension, a Firefox add-on, and a Microsoft Edge add-on. It operates on AWS Console pages and supports browser synchronization across the supported browsers. That makes it more convenient than a local command-line switcher when the desired task is to change accounts inside the console itself. It does not replace the IAM policies and trust relationships that determine whether a role can actually be assumed. The extension presents roles and invokes the console workflow, but the documentation does not claim that it grants permissions or bypasses AWS authorization.

There is also experimental support for AWS Management Console multi-session behavior. That is worth noting because the extension is tied closely to the console experience rather than providing a separate AWS administration interface.

Profile Configuration and Role Selection

Configuration uses INI syntax similar to ~/.aws/config or ~/.aws/credentials. The simplest form describes target roles directly. A profile can contain role_arn, or it can contain aws_account_id together with role_name. Optional settings include color, region, and image. The color value is an RGB hex value without the # prefix, and an image can be placed above a configured color.

For example, the README documents a target role defined by an ARN and another defined by an account ID and role name:

[profile marketingadmin]
role_arn = arn:aws:iam::123456789012:role/marketingadmin
color = ffaaee

[anotheraccount]
aws_account_id = 987654321987
role_name = anotherrole
region=ap-northeast-1

A role ARN gives the extension the account and role in one value. The account-and-role form is easier to maintain when the same configuration is assembled from separate identifiers. The region setting changes the selected region during a role switch when it is supplied. The color and image settings affect the extension's menu presentation, not AWS resource configuration.

The extension can also represent several base accounts and their related target roles. In this model, a base account is a profile referenced by source_profile. A target role belongs to a base account by naming that base profile in source_profile. This is useful when accounts share organizational or account-switching rules, but it also makes the configuration sensitive to naming mistakes. A wrong source_profile can hide or misclassify roles.

Base accounts can define defaults with target_role_name and target_region. An individual target profile can override the default role name. A base account can also specify role_name to check for the role used to sign in to AWS. For an SSO permission set beginning with AWSReservedSSO_, the value should be only the permission set name. The README warns against supplying the full AWSReservedSSO_ form in that case.

AWS Organizations Filtering and Login Boundaries

The Show only matching roles setting addresses account structures in which several accounts expose roles with the same name. The documented example uses a Developer role in a master account and member accounts that have a role with the same name. If the current role is Developer, checking the option causes the extension to show member-account roles whose role_arn ends in role/Developer. It does not display roles that the current role cannot assume.

This filtering depends on the relationship between the currently signed-in role and the candidate target roles. It is therefore different from a general permission query. The extension cannot make an unassumable role available merely because its name matches. Users still need valid AWS IAM trust policies, identity permissions, and any applicable organization or identity-provider conditions.

The README documents another important boundary: if a user signs in to a base account, target roles belonging to other base accounts are excluded. That behavior prevents unrelated role groups from appearing together, but it may surprise users who have one large flat role list in mind. The complex configuration requires deliberate separation between base accounts and target roles.

AWS SSO and SAML support needs careful interpretation. The project says it does not support switching between AWS accounts that users sign into directly with AWS SSO or SAML solution providers. It does, however, describe a base-account role_name feature that can be used with an SSO identity provider when that provider signs in to a base account. In other words, the extension can help organize roles after a federated login reaches a base account, but it is not a general session switcher for independent SSO or SAML sign-ins.

Installing the Browser Extension and Making the First Switch

The README directs users to the official browser-store listings rather than providing a separate manual installation command. Choose the listing for the browser in use, install the extension, and open the AWS Management Console. The extension should be used only on AWS Console pages, according to the project's distribution guideline.

After installation, left-click the extension, click Configure, enter the INI configuration in the text box, and click Save. Start with one profile that you know you can assume. The following is the smallest documented target-role form:

[anotheraccount]
aws_account_id = 987654321987
role_name = anotherrole

Save the configuration, open the extension menu in an AWS Console page, and select the profile. The console should present the role-switch workflow using the configured account and role. If the role does not appear or cannot be selected, first verify that the signed-in identity has permission to assume it and that the target role's trust policy permits the current identity.

The configuration text is entered manually in the extension interface. The README does not document importing a local file through a picker or synchronizing the configuration from ~/.aws/config automatically. It does document browser Sync support, but that feature should not be interpreted as documented local-file synchronization. The first use is therefore a manual paste-and-save operation.

For a larger setup, add profiles gradually and confirm the grouping behavior before relying on it. The extension's menu is intended to make a configured list available, but a long configuration can be difficult to audit if role names and account identifiers are inconsistent.

Maintenance, Browser Limits, and Project Boundaries

The repository is not archived, and its last push was on 2026-10-11. The project also has releases v6.2.1 on 2026-07-09 and v6.2.0 on 2026-07-05. This indicates recent repository activity, but the documentation still imposes a support boundary: the project states that it supports only the latest version of each official browser. It says this restriction comes from the JavaScript language features used, rather than from an intentional block on other Chromium-compatible browsers.

The package uses JavaScript and is published under the MIT license. The package metadata identifies the dependency aesr-config, with development and testing packages including Rollup, Playwright, Mocha, Chai, and jsdom. Those repository details indicate a build and test structure, but the README does not provide an end-user build tutorial or explain browser-store release signing. Users who want to modify the extension should inspect package.json, the manifest files, the build scripts under bin/, and the source under src/ rather than assuming the store package is the only supported distribution path.

The main operational limitation is not a missing role. It is the mismatch between identity sessions and role switching. Users who rely on direct AWS SSO or SAML sessions need a different workflow for switching between independently authenticated accounts. Users who need broad account discovery across unrelated organizations will also find the base-account filtering restrictive. The extension is best treated as a carefully configured console menu, not as a replacement for IAM administration, permission auditing, or federated-session management.

AWS Extend Switch Roles Compared with Browser Session Tools

A real alternative is the AWS Management Console's built-in switch-role interface, supported by an account history of up to five roles. The built-in interface has a smaller role list, but it is part of AWS itself and does not require a third-party browser extension to present its standard switch workflow. AWS Extend Switch Roles adds manual configuration, optional grouping, visual markers, and filtering for larger account structures.

Another alternative is managing role selection outside the console with AWS CLI profiles and commands. AWS Extend Switch Roles uses the same INI-style vocabulary, including role_arn, aws_account_id, role_name, and source_profile, but its operational surface is the browser extension menu.

The choice depends on where switching happens. Choose the built-in console workflow when five remembered roles are sufficient and avoiding an extension is a priority. Choose AWS Extend Switch Roles when administrators need a larger, manually defined browser menu. Choose CLI-based profile management when commands, scripts, or terminal sessions are the primary interface. None of these choices changes the AWS trust requirements for assuming a role.

Editorial conclusion

AWS Extend Switch Roles fits administrators who need a manually defined role menu in the AWS Management Console and who use browser-based IAM role switching. It is a poor fit for users who sign into separate AWS accounts directly through AWS SSO or SAML and expect the extension to switch between those sessions. Before adopting it, verify the extension's browser support, confirm that each target role can be assumed, and review the profile structure, especially source_profile and Show only matching roles.

Frequently asked questions

Official sources

1. License: MIT
2. Project website
3. README
4. Releases
5. tilfinltd/aws-extend-switch-roles on GitHub