Model a Terraform provider alias to manage resources across multiple AWS accounts in a single root module using assume_role and distinct provider blocks

Steps

1. Declare a default aws provider block for the management account and additional aliased provider blocks using provider "aws" { alias = "prod" } each with an assume_role block specifying the cross-account role ARN
2. Pass the aliased provider to resources and modules using the provider meta-argument: provider = aws.prod; for modules, use providers = { aws = aws.prod } in the module call block
3. Store account IDs and role ARNs in a locals block or variable map rather than hardcoding them; use a for_each on a map of account configs to generate per-account provider blocks dynamically where Terraform's provider meta-programming allows
4. Configure the S3 backend with a single bucket in the management account and use workspaces or path prefixes to isolate state per account rather than running separate backends
5. Add a data source in each aliased provider context to fetch the current caller identity and assert the expected account ID using a precondition block to fail fast if the wrong role is assumed
6. In CI, supply credentials for the management account only and rely on assume_role chaining; add an iam:AssumeRole permission boundary on the automation role to limit blast radius