The stock template "AWS by HTTP" (also "AWS by HTTP Custom") has two defects in the
"Backup vault discovery" LLD rule (key: aws.backup_vault.discovery, type: Script) that
make it always fail when {$AWS.AUTH_TYPE}=assume_role.

Steps to reproduce:
1. Link "AWS by HTTP" to a host and configure assume_role auth:
   {$AWS.AUTH_TYPE}=assume_role, {$AWS.ASSUME.ROLE.AUTH.METADATA}=true,
   {$AWS.ASSUME.ROLE.ARN}=arn:aws:iam::<acct>:role/<role>, {$AWS.STS.REGION}=<region>.
2. Enable the "Backup vault discovery" discovery rule.
3. Execute the rule (Execute now) and watch the server log.

Result:

Bug 1 - metadata_auth parameter is missing from the rule.
The embedded script requires, for auth_type == assume_role:
    if (typeof params.metadata_auth === 'undefined' || params.metadata_auth === '' ||
        (params.metadata_auth !== 'true' && params.metadata_auth !== 'false'))

But the discovery rule's Parameters list does NOT include metadata_auth, while the
"EC2 instances discovery" and "RDS instances discovery" rules in the SAME template DO
include it (metadata_auth = {$AWS.ASSUME.ROLE.AUTH.METADATA}). So it always fails with:
    [ AWS Backup vault ] ERROR: Required param metadata_auth for assume_role is not set
    or has invalid value: "undefined". Expected "true" or "false".

Bug 2 - STS AssumeRole request is missing the canonical_uri argument.
The request helper is defined with 6 args:
    request: function (method, canonical_uri, region, service, params, data)
All calls pass 6 args EXCEPT the STS AssumeRole call, which passes 5 (canonical_uri missing):
    AWS.request('GET', AWS.params.sts_region, 'sts', AWS.prepareParams(payload))
With the missing arg the parameters shift, so
    host = service + '.' + region + '.amazonaws.com'
becomes "<query-string>.sts.amazonaws.com", producing:
    [ AWS Backup vault ] ERROR: Error: cannot get URL: URL rejected: Bad hostname.
This manifests on the assume_role + metadata_auth=true path (assume_role_metadata), which
performs the STS call. The EC2 script's request is defined and called with 5 args
consistently, so EC2/RDS are unaffected.

Expected:

• metadata_auth = {$AWS.ASSUME.ROLE.AUTH.METADATA} should be present in the
    "Backup vault discovery" rule parameters (same as EC2/RDS discovery).
• The STS AssumeRole call should pass the canonical_uri:
      AWS.request('GET', '/', AWS.params.sts_region, 'sts', AWS.prepareParams(payload))

After applying both fixes locally, assume_role authentication and the backup ListBackupVaults
call return HTTP 200 and the discovery rule retrieves the vault list successfully.

Both issues are present in the stock templates (and in release/7.4 at the time of writing).
The same two fixes are needed in "AWS by HTTP Custom" as well.