Add AWS STS AssumeRole configuration UI for AWS Bedrock endpoints

[e19166]

Related issue: https://github.com/wso2-enterprise/wso2-apim-internal/issues/17821

Adds the Publisher UI for configuring AWS STS AssumeRole on AI (Bedrock)
endpoints. Previously the AWS endpoint configuration only accepted a static
access key / secret key. This PR adds an option to assume an IAM role — bootstrapped
from those stored credentials — so the gateway can obtain temporary credentials
before signing Bedrock requests.

The backend support (endpoint model + AWSSigV4Signer mediator) and the sequence
template are submitted separately — see Related PRs.

Approach

In the AI endpoint configuration (AddEditAIEndpoint), under the AWS credential
fields, added an "Enable STS AssumeRole" checkbox. When enabled, it reveals:

Field	Required	Notes
Role ARN	Yes	IAM role to assume
Role Region	Yes	STS region for the AssumeRole call (region select)
External ID	No	Sent only when the role's trust policy requires it

The fields are laid out and styled to match the existing AWS Lambda endpoint
AssumeRole configuration for consistency. The Access Key / Secret Key / Region
fields remain required, since they bootstrap the AssumeRole call.

Behavior details:

• The checkbox and role fields hydrate from a previously saved configuration
  (a saved Role ARN re-checks the box and repopulates the fields on load).
• Toggling the checkbox off clears the persisted roleArn / roleRegion /
  roleExternalId so a disabled role isn't silently retained.
• Editing the role fields persists correctly without requiring the already-stored
  Secret Key (shown as the ******** placeholder) to be re-entered; the literal
  placeholder is never saved back as a real secret.

Automation tests

Added AddEditAIEndpoint.test.jsx covering:

• Role fields are hidden when AssumeRole is unchecked and shown once checked.
• Checkbox and Role ARN hydrate from a previously saved configuration.
• Unchecking clears the role values from the config that is actually saved.
• Editing the Role ARN / External ID persists to the saved configuration, and the
  ******** secret-key placeholder is never persisted as a real value.

Manual tests

• Configured a Bedrock endpoint with AssumeRole enabled in the Publisher, saved,
  redeployed, and confirmed the role values reached the gateway.
• Verified the static-credential flow (AssumeRole unchecked) is unchanged.

Related PRs

• carbon-apimgt (endpoint model + gateway mediator): Add role assume feature for bedrock endpoints carbon-apimgt#13928
• product-apim (AI endpoint sequence template): Wire AWS STS AssumeRole properties into the AI API endpoint sequence template product-apim#14266

UI changes

Added the "Enable STS AssumeRole" section (Role ARN, Role Region, External ID) to
the AI/Bedrock endpoint configuration screen.

Checklist

• Frontend tests added
• i18n keys added (en.json)
• Related PRs linked

[coderabbitai]

Warning

Review limit reached

@e19166, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 53 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 22310cf0-2480-4c34-8a8d-674278ffe1a5

📥 Commits

Reviewing files that changed from the base of the PR and between b96353b and 40ad612.

📒 Files selected for processing (2)

• portals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AIEndpoints/AddEditAIEndpoint.jsx
• portals/publisher/src/main/webapp/source/src/app/components/Apis/Details/Endpoints/AIEndpoints/AddEditAIEndpoint.test.jsx

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
4.2% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud