# tenant's crossplane provider config
apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: tenant-provider
spec:
  assumeRoleARN: arn:aws:iam::{AWS_ACCOUNT_ID}:role/{ROLE_NAME}
  credentials:
    source: InjectedIdentity
  externalID: {EXTERNAL_ID}