terraform AWS assume role provider

.tf

#-- External provider -------------------------------------------------------
provider "aws" {
  version = "~> 2.0"
  region  = "<AWS_REGION>"
  assume_role {
    role_arn = "${var.provider_env_roles[terraform.workspace]}"
  }
}

#-- var.tf -------------------------------------------------------------------
variable "provider_env_roles" {
  type    = "map"
  default = {
    "<ENV_1>"     = ""
    "<ENV_2>"    = "arn:aws:iam::<AWS_ACCOUNT_2>:role/<ROLE_NAME>"
  }
}