aws-credentials: add AWS Greengrass endpoint details

[ShelbyZ]

Add documentation for support of AWS Greengrass endpoint

Related: fluent/fluent-bit#11369

Summary by CodeRabbit

• Documentation
  • Added AWS Greengrass credentials documentation and a new navigation entry for "AWS Greengrass credentials".
  • Documented how to retrieve credentials from the local Greengrass token exchange service, described relevant environment variables, and linked to the token exchange service documentation.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request adds a navigation entry and a new "AWS Greengrass credentials" section to the AWS credentials documentation, explaining how to retrieve credentials from the local Greengrass token exchange service and which environment variables are used.

Changes

Cohort / File(s)	Change Summary
Documentation Updates administration/aws-credentials.md	Added navigation link and new section documenting AWS Greengrass credentials retrieval, describing use of the local Greengrass token exchange service and environment variables (AWS_CONTAINER_CREDENTIALS_FULL_URI, AWS_CONTAINER_AUTHORIZATION_TOKEN) with a reference link to token exchange docs

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Poem

🐰 I hopped through the docs to find,
A Greengrass token left behind.
Env vars set, the secrets flow,
Small changes make integrations grow. 🌿

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately describes the main change: adding AWS Greengrass endpoint documentation to the AWS credentials file.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 28c57c8 and c9396e4.

📒 Files selected for processing (1)

• administration/aws-credentials.md

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2025-12-12T14:30:18.461Z

Learnt from: kalavt
Repo: fluent/fluent-bit-docs PR: 2294
File: pipeline/inputs/kafka.md:147-168
Timestamp: 2025-12-12T14:30:18.461Z
Learning: In Fluent Bit v4.0.4+, when using AWS MSK IAM authentication (rdkafka.sasl.mechanism: aws_msk_iam), the rdkafka.security.protocol is automatically set to SASL_SSL and the AWS region is auto-detected from the broker hostname for standard MSK endpoints. The aws_msk_iam_cluster_arn parameter was removed - users only need to set rdkafka.sasl.mechanism: aws_msk_iam (and optionally aws_region for custom DNS/PrivateLink).

Applied to files:

• administration/aws-credentials.md

🔇 Additional comments (2)

administration/aws-credentials.md (2)

10-10: LGTM! Navigation entry is correctly formatted.

The navigation link follows the same pattern as other entries and correctly references the new section heading.

---

47-49: Documentation is clear and accurate.

The section correctly explains how Fluent Bit retrieves credentials from the Greengrass token exchange service, lists the relevant environment variables, and provides a helpful link to AWS documentation. The credential chain order is clearly documented with Greengrass positioned last, after EC2 IMDS.

Note: The unusual positioning of Greengrass after IMDS (versus typical AWS SDK patterns where container credentials are evaluated before IMDS) appears intentional based on the documented implementation. To fully understand the rationale for this ordering, consider checking the implementation details in fluent/fluent-bit PR #11369.

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cosmo0920]

For technical perspective, it looks good to me.

[ShelbyZ]

As for the Lint PRs tooling - https://github.com/fluent/fluent-bit-docs/actions/runs/21009761247/job/60425402810?pr=2323

  Warning: [vale] reported by reviewdog 🐶
  [FluentBit.Spelling] Spelling check: 'Greengrass'?
  
  Raw Output:
  {"message": "[FluentBit.Spelling] Spelling check: 'Greengrass'?", "location": {"path": "administration/aws-credentials.md", "range": {"start": {"line": 10, "column": 8}}}, "severity": "INFO"}
  Warning: [vale] reported by reviewdog 🐶
  [FluentBit.Headings] 'AWS Greengrass credentials' should use sentence-style capitalization.
  
  Raw Output:
  {"message": "[FluentBit.Headings] 'AWS Greengrass credentials' should use sentence-style capitalization.", "location": {"path": "administration/aws-credentials.md", "range": {"start": {"line": 47, "column": 4}}}, "severity": "INFO"}
  Warning: [vale] reported by reviewdog 🐶
  [FluentBit.Spelling] Spelling check: 'Greengrass'?
  
  Raw Output:
  {"message": "[FluentBit.Spelling] Spelling check: 'Greengrass'?", "location": {"path": "administration/aws-credentials.md", "range": {"start": {"line": 47, "column": 8}}}, "severity": "INFO"}
  Warning: [vale] reported by reviewdog 🐶
  [FluentBit.Spelling] Spelling check: 'Greengrass'?
  
  Raw Output:
  {"message": "[FluentBit.Spelling] Spelling check: 'Greengrass'?", "location": {"path": "administration/aws-credentials.md", "range": {"start": {"line": 49, "column": 75}}}, "severity": "INFO"}
  Warning: [vale] reported by reviewdog 🐶
  [FluentBit.Spelling] Spelling check: 'Greengrass'?

I've seen it as AWS Greengrass, AWS IOT Greengrass, and Greengrass - so the spelling should not be an issue.

[alexakreizinger]

@ShelbyZ thanks for the PR! (and feel free to ignore our linter for the "Greengrass" flag; it uses a pretty strict dictionary, so we'll have to add that to its allowlist later 😆)

I added one small suggestion, but otherwise LGTM :)