[FEATURE] Claude Apps Gateway: Customize STS role session name with OIDC user identity for Bedrock invocation logs

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

When the Claude Apps Gateway routes inference to Amazon Bedrock, it uses the ECS task role to sign the SigV4 request. This means:

• CloudTrail logs show the task role ARN for all InvokeModelWithResponseStream calls — no per-user attribution
• Bedrock Invocation Logging attributes all requests to the same IAM principal
• Enterprises with compliance requirements (e.g., NERC CIP) need user-level attribution in their native AWS audit trail, not just in OTLP telemetry

The Gateway already knows the authenticated user's identity (OIDC sub, email, groups) — it's stamped on every request for telemetry. But that identity doesn't flow through to the AWS API call.

Proposed Solution

When calling bedrock-runtime:InvokeModelWithResponseStream, the Gateway should AssumeRole with a custom RoleSessionName derived from the authenticated user's identity (e.g., their OIDC sub or email).

For example:

• Task role assumes itself (or a dedicated invoke role) with: RoleSessionName=gateway-user-<oidc_sub> or RoleSessionName=<email>
• CloudTrail then logs: arn:aws:sts::123456789:assumed-role/GatewayBedrockRole/gateway-user-jsmith
• Bedrock invocation logs inherit this session identity

Configuration surface (suggestion):

upstreams:
  - provider: bedrock
    region: us-east-1
    auth:
      role_session_name_claim: email  # or "sub", "preferred_username"

Alternative Solutions

1. Rely solely on OTLP telemetry — works for dashboards but doesn't satisfy compliance frameworks that require attribution in the native cloud audit trail
2. One IAM role per user — doesn't scale and defeats the purpose of the Gateway
3. Custom request headers — Bedrock doesn't propagate custom headers to invocation logs today

Priority

High - Significant impact on productivity

Feature Category

Other

Use Case Example

Regulated utility (NERC CIP) deploying Claude Code to 200+ engineers via the Gateway on Amazon Bedrock. Security team requires every Bedrock invocation to be attributable to an individual in CloudTrail for audit purposes. OTLP telemetry provides this in dashboards, but the compliance framework mandates attribution in the native AWS control plane audit trail. Without per-user session names, the only alternative is one IAM role per developer — which eliminates the centralized credential benefit of the Gateway entirely.

Additional Context

This would make the Gateway a complete governance story for regulated industries where OTLP telemetry is valuable but insufficient — the native AWS audit trail must also attribute actions to individuals. The STS AssumeRole approach is a proven pattern (used by AWS SSO/Identity Center, EKS IRSA, etc.) and would add minimal latency since STS token caching is standard.