Expose Bedrock IAM role in GraphQL

What does this merge request do and why?

• What? Exposes the IAM role field for Bedrock models through the GraphQL API.
• Why? To provide an API-first win for toggling the role to assume before invoking Bedrock models. Currently only the default AWS credentials will be used.

🤖 Claude summary

Exposes the optional Bedrock IAM role through GraphQL (iamRole on the self-hosted model type and mutation inputs). It also passes the instance ID to the admin page so the form can show the STS ExternalId that the role's trust policy must require.

This is layer 2 of 3 and is stacked on !259000 (merged), which adds the model column. The admin form and its documentation (the trust policy and the IAM role field) are in layer 3, !259629 (merged), so the docs do not describe a field that does not exist yet. Splitting backend GraphQL from the frontend avoids the multiversion compatibility problem Danger flagged on the original MR.

References

• Layer 1: !259000 (merged)
• Companion AI Gateway MR: gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!7210 (merged)

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

---

🤖 Written by Claude (Sonnet 5.5) on behalf of Erran Carey.