fix: add external id to aws assume role (#2384)

Author: everpcpc

docs/en/guides/40-load-data/00-stage/06-aws-iam-role.md

@@ -4,7 +4,14 @@ title: "Creating External Stage with AWS IAM Role"
 
 # Why IAM Role
 
-With AWS IAM Role, you can access your own AWS S3 buckets in Databend Cloud. This allows you to securely access your data and perform data analysis without having to manage your AWS credentials.
+AWS IAM (Identity and Access Management) Role provides a secure and flexible way to manage access to your AWS resources. When working with Databend Cloud, using IAM Role offers several key benefits:
+
+- **Enhanced Security**: Instead of storing AWS access keys and secrets, IAM Role enables temporary credential access, significantly reducing security risks.
+- **Simplified Access Management**: You can manage permissions centrally through AWS IAM, making it easier to control who can access your S3 buckets and what operations they can perform.
+- **Seamless Integration**: Databend Cloud can securely access your AWS S3 buckets without requiring you to manage or rotate credentials manually.
+- **Compliance and Audit**: IAM Role provides detailed audit trails of access to your S3 buckets, helping you maintain compliance with security policies.
+
+By using IAM Role, you can securely connect your Databend Cloud environment to your AWS S3 buckets while maintaining full control over access permissions and security policies.
 
 # How to Use IAM Role
 
@@ -57,6 +64,11 @@ With AWS IAM Role, you can access your own AWS S3 buckets in Databend Cloud. Thi
          "Principal": {
            "AWS": "arn:aws:iam::123456789012:role/xxxxxxx/tnabcdefg/xxxxxxx-tnabcdefg"
          },
+         "Condition": {
+           "StringEquals": {
+             "sts:ExternalId": "my-external-id-123"
+           }
+         },
          "Action": "sts:AssumeRole"
        }
      ]
@@ -72,7 +84,7 @@ With AWS IAM Role, you can access your own AWS S3 buckets in Databend Cloud. Thi
 4. Run the following SQL statement in Databend Cloud cloud worksheet or `BendSQL`:
 
    ```sql
-   CREATE CONNECTION databend_test STORAGE_TYPE = 's3' ROLE_ARN = 'arn:aws:iam::987654321987:role/databend-test';
+   CREATE CONNECTION databend_test STORAGE_TYPE = 's3' ROLE_ARN = 'arn:aws:iam::987654321987:role/databend-test' EXTERNAL_ID = 'my-external-id-123';
 
    CREATE STAGE databend_test URL = 's3://test-bucket-123' CONNECTION = (CONNECTION_NAME = 'databend_test');