Optional. The ARN of an IAM role for the plugin to assume, such as arn:aws:iam::111122223333:role/InspectorCICDscan-role. If you choose OIDC Credentials, the plugin assumes the role with that ID token. Otherwise it uses the credentials that the Jenkins controller already has, such as an EC2 instance profile, and those need permission to call sts:AssumeRole on the role.

If you set more than one authentication option, the plugin uses the first one in this order: AWS Credentials, IAM Role with OIDC Credentials, IAM Role, and then AWS Profile Name. If you set none of them, it uses the default credential provider chain on the Jenkins controller.

For more info: https://docs.aws.amazon.com/inspector/latest/user/cicd-jenkins.html