I believe the solution is to give the account an alias.
https://docs.aws.amazon.com/IAM/latest/UserGuide/console_acc...
https://docs.aws.amazon.com/IAM/latest/UserGuide/console_acc...
pros: cannot get accounts mixed up.
cons: All sessions are actually 12hr sessions (ASIA not AKIA) and no access to perm keys for cli, security i suppose. Its not too bad though as TVM gives creds for various use cases.