interface SandboxesProxyAwsStaticConfigRoleARN selects automatically renewed IAM-role credentials instead of static keys. Access follows the role's effective AWS permissions, not the sandbox's mount scope. Configure at creation; the role cannot be changed afterward.