Add EKS Pod Identity authn docs for S3 repository

[DaveCTurner]

Summary

Documents how to use EKS Pod Identity credentials with the S3 snapshot repository, as a companion to elastic/elasticsearch#151614. Adds an "Using EKS Pod Identity for authentication" subsection alongside the existing IRSA instructions: symlink the injected token into ${ES_PATH_CONF}/repository-s3/eks-pod-identity-token and repoint AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE (or the aws.containerAuthorizationTokenFile system property) at the symlink so the S3 repository can read it.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.).

Tool(s) and model(s) used: Anthropic Claude (Opus 4.8)

NB just a copy of #7182 which was opened from a fork.

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• deploy-manage/tools/snapshot-and-restore/s3-repository.md

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[wajihaparvez]

Suggested change

If you run {{es}} on Amazon EKS and want to use [EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) for authentication, EKS injects a token file into the pod and sets the `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` environment variable to point at it. However, {{es}} is forbidden from reading files at this location for security reasons. To use EKS Pod Identity, add a symlink at `${ES_PATH_CONF}/repository-s3/eks-pod-identity-token` which links to the token file, then set the `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` environment variable to the location of this symlink. For example:

If you run {{es}} on Amazon EKS and use [EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) for authentication, EKS injects a token file into the pod and points the `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` environment variable to it. However, {{es}} is forbidden from reading files at this location for security reasons. To enable {{es}} to access this file, add a symlink at `${ES_PATH_CONF}/repository-s3/eks-pod-identity-token` which links to the token file, then set the `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` environment variable to the location of this symlink. For example:

[wajihaparvez]

Thanks for updating the docs, @DaveCTurner! I suggested some edits for clarity. LGTM otherwise

[DaveCTurner]

#7182 merged, closing this.