### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

## What happened

When using aws_web_identity_token + aws_role_name (OIDC federation via AssumeRoleWithWebIdentity) to authenticate a bedrock_mantle/ model, every request fails with: ``` litellm.APIConnectionError: Bedrock_mantleException - {"error":{"code":"access_denied","message":"User: arn:aws:sts::<account>:assumed-role/<role>/litellm-session is not authorized to perform: bedrock-mantle:CreateInference on resource: arn:aws:bedrock-mantle:us-east-1:<account>:project/default because no session policy allows the bedrock-mantle:CreateInference action","param":null,"type":"permission_denied_error"}} ```

This happens even when the target IAM role's own identity-based policy explicitly grants bedrock-mantle:CreateInference on arn:aws:bedrock-mantle:*:<account>:project/*.

Root cause

_auth_with_web_identity_token in litellm/llms/bedrock/base_aws_llm.py attaches a hardcoded inline session Policy to every sts:AssumeRoleWithWebIdentity call:

```json { "Version": "2012-10-17", "Statement": [ { "Sid": "BedrockLiteLLM", "Effect":…