Dump roles on AWS without pg_dumpall -g access (postgresql 9.6.8)?
It turns out the 10.0 solution was backported (apparently) to 9.6.8, so:

pg_dumpall --host &lt;aws_endpoint&gt; --globals-only --no-role-passwords \
    --username masteruser &gt;roles.sql


Then run roles.sql against the new database.