I’m trying to run local docker containers as airflow cluster for local testing. My DAG needs to run some code like sts_client.assume_role. It works with ECS. However in local containers, it only gets my identity as arn:aws:sts::xxx:assumed-role/okta-dev/xxxx.com, which is not listed in the trust relationship of the role DAG code to assume.
Questions are:

1. I think we can try to add the arn:aws:sts::xxx:assumed-role/okta-dev/xxxx.com to the trust relationship of assume role, but is there a better way to make it work? In ECS, the identity is like arn:aws:sts::xxx:assumed-role/xxx-container/xxx which has been added to target roles.
2. If we have to add the okta arn to the role, each of the team members needs to do that. In that case, can we make all okta arn to assume one role in, say, <middle_role>, and use add that middle role to target role DAG needs to assume? That is:
   Add all okta arns to trust relationship of middle_role => add middle_role to trust relationship of target roles.

Thanks