Include a section about session tagging (#1031)

Author: tomasmik

docs/integrations/cloud-providers/aws.md

@@ -196,6 +196,39 @@ You will immediately see the stacks and modules that already have your label in
 !!! info
     You have to enable auto-attach on each integration individually to prevent clashes with previous labels in your account.
 
+## Session tagging
+
+You can enable session tagging to have Spacelift attach run and stack metadata as tags when assuming your IAM role. These tags show up in CloudTrail logs, providing additional context for auditing.
+
+To use session tagging, enable the **Enable tag session** option when creating or editing your AWS integration. Your IAM role's trust policy will need to include both `sts:AssumeRole` and `sts:TagSession` permissions as separate statements:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "<spacelift-principal>"
+      },
+      "Action": "sts:TagSession"
+    },
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "AWS": "<spacelift-principal>"
+      },
+      "Action": "sts:AssumeRole",
+      "Condition": {
+        "StringLike": {
+          "sts:ExternalId": "your-account@*"
+        }
+      }
+    }
+  ]
+}
+```
+
 ## Are my credentials safe?
 
 Assuming roles and generating credentials **on private worker** is perfectly safe. Those credentials are never leaked to us in any shape or form.