and a framework for a 'real' account vending machine.
If you've delegated AWS SSO / IC to a separate account, take a look at this.