### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

LiteLLM v1.92.0’s Bedrock OIDC path calls AssumeRoleWithWebIdentity with a fixed restrictive STS session policy. It permits bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream, but omits bedrock:CountTokens. Since STS session policies cap effective permissions, the request returns 403 even when the assumed role policy explicitly grants bedrock:CountTokens.

Minimal patch: ```json "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", + "bedrock:CountTokens", "bedrock:ApplyGuardrail", ```

**Observed error:** HTTP error in CountTokens handler: Client error '403 Forbidden' https://bedrock-runtime.us-east-2.amazonaws.com/model/anthropic.claude-sonnet-5/count-tokens

### Steps to Reproduce

## Steps to reproduce

1. Create or use an AWS IAM role whose identity policy permits `bedrock:CountTokens`:

```json { "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream", "bedrock:CountTokens" ], "Resource": "*" } …