Optional IAM role ARN to assume before invoking Bedrock. Jenkins first uses its normal AWS credential chain, then calls STS AssumeRole and uses the temporary credentials for Bedrock Runtime requests.