When configuring Bring Your Own LLM (BYOLLM) with AWS Bedrock using the IAM assume-role method, customers are currently required to provide their own sts:ExternalId value and store it as a Port secret (OPTIONAL_EXTERNAL_ID). This value is then referenced as plain text in the IAM trust policy.

Best practice would be for Port to generate this value on behalf of the customer, rather than requiring the customer to define it themselves.