Allow dynos to assume an AWS IAM role without using an access key

### Required Terms

- [X] I agree to follow this project's [Code of Conduct](https://github.com/heroku/roadmap/blob/main/CODE_OF_CONDUCT.md)
- [X] I have read and accept the [Salesforce Program Agreement](https://www.salesforce.com/company/program-agreement/)

### What service(s) is this request for?

Heroku dynos

### Tell us about what you're trying to solve. What challenges are you facing?

Amazon recommends avoiding using long-term credentials like access keys for security reasons. It's best practice to rotate these credentials frequently. This is an administrative overhead.

We regularly set an AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY secret in each application to allow it to perform actions in our AWS account.

Can we find a way to authorise dynos in our AWS account without requiring static secrets?

---

Other systems allow us to let them assume a role in our AWS account. We create a role with the trust policy that allows a user in their AWS account to assume the role.

In this hypothetical implementation:
- Heroku would provide the AWS Account ID and an External ID that we would use to set up a role in our AWS account.
- We would add the role ARN to our Heroku applications configuration.
- On dyno startup, Heroku would retrieve temporary credentials and supply them to the running process.

I wonder if this is technically feasible. I note that [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) has a maximum duration of 12 hours, which would limit the length of time a dyno would be able to run.