Thank you for the suggestions! However, I’m not sure this will work; we were hoping to use images in our private ECR as the base layer(s) for our cloud agent dev environments to de-duplicate steps between what our production images define and the proposed dev environment. Moving these steps into RUN steps defeats that purpose.
It sounds like build-time IAM role assumption isn’t currently supported; I’ll start a new feature request thread. Thank you again for your help!