The role support-readonly trusts admin and has ReadOnlyAccess. The support desk uses it to look at a customer's problem without being able to change anything.

1. Assume the role once, with the session name ticket-42, and read the credentials it returns.
2. Set up a profile named support that assumes support-readonly for every command, using admin's default profile to ask. That takes two commands.
3. Ask who you are with the support profile.
4. With the support profile, list the buckets, then try to make the bucket support-scratch-sb1h9d.