LegionIO AWS IAM identity provider — resolves machine identity from STS and provides session credentials via instance profile or AssumeRole