It is often useful to have the service assume a role after using its
given credentials (even when such credentials are, themselves, already a
web identity role).