Pass Bedrock IAM role in code suggestions requests

Erran Careyrequested to merge
erran/bedrock-sts-assume-role-code-suggestions into master

⚠️ AI-authored draft. Written by Claude (Sonnet 5.5) on behalf of Erran Carey. Specs pass locally; CI has not run yet.

What does this merge request do and why?

Passes the Bedrock IAM role in code suggestions requests, as raised in !259000 (comment 3961680594). The legacy self-hosted code completion request builders (AiGatewayCodeCompletionMessage#params and #request_params, and Ai::FeatureSetting#model_request_params) built their own model_* parameters without the role, so a Bedrock model with an IAM role would be called without it for code completion.

They now send it as model_iam_role. Chat, code generation, the code editor completion and the other prompts already receive iam_role through Gitlab::Llm::AiGateway::ModelMetadata; this MR adds a spec confirming that for chat.

AI Gateway has to accept model_iam_role on its completions endpoint before the role takes effect for code completion. Until then it ignores the field, which is harmless. That change is not part of this MR.

This is stacked on !259629 (merged) (layer 3); it only depends on the model column from !259000 (merged).

References

How to set up and validate locally

  1. On a Bedrock self-hosted model with an IAM role, assign it to Code Completion.
  2. Trigger a code completion request and confirm the request to AI Gateway carries model_iam_role.
  3. Confirm a model without a role, and a non-Bedrock model, send no model_iam_role.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

🤖 Written by Claude (Sonnet 5.5) on behalf of Erran Carey.

Merge request reports