Add IAM role field to self-hosted model form

What does this merge request do and why?

• What? Adds a field to enter the IAM role to assume when invoking bedrock models.
• Why? Customers rely on the AI Gateway deployment's default AWS credentials which may not have permission to invoke models in the customer account/region/etc.

Screenshots or screen recordings

Before	After

🤖 Claude summary

Adds an optional IAM role to assume field to the Amazon Bedrock model form for GitLab Duo Self-Hosted. It submits iamRole, links to the trust policy documentation and shows the ExternalId to require in that policy.

This is layer 3 of 3 and is stacked on the GraphQL changes in layer 2. Layer 1 has merged; merge layer 2 (!259628 (merged)) before this one. It also carries the documentation for the field, including the trust relationship policy with the sts:ExternalId condition, moved here from the GraphQL MR so the docs land with the field they describe.

References

• Layer 1 (merged): !259000 (merged)
• Layer 2 (GraphQL): !259628 (merged)
• Companion AI Gateway MR: gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!7210 (merged)

How to set up and validate locally

1. Configure a self-hosted model with the Amazon Bedrock platform in the Duo admin page.
2. Confirm the "IAM role to assume" field appears for Bedrock only, accepts a valid role ARN and rejects a malformed one.
3. Confirm the "Learn more" link opens the "Assume an IAM role with AWS Bedrock" docs section.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

---

🤖 Written by Claude (Sonnet 5.5) on behalf of Erran Carey.