Clarify assumed-role ARN requirement in WIF identity and intake mapping setup (#37614)

* Clarify assumed-role ARN requirement in WIF identity and intake mapping setup

Adds warning callouts to both the identity mapping and intake mapping UI
sections explaining that Datadog requires the assumed-role ARN (STS format)
rather than the IAM role ARN shown in the AWS Console. Updates the Source
Pattern example to show the full arn:aws:sts:: format. Adds guidance on
using aws sts get-caller-identity to find the correct ARN value.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Update workload_identity_federation.md

* Scope WIF warning callout to opening sentence, add aws sts tip for parity

Move the ARN format list and aws sts get-caller-identity tip outside the
alert div so only the opening sentence carries the warning style. Add the
tip to the identity mappings warning to match the intake mappings warning.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: anthony-dgx

content/en/account_management/workload_identity_federation.md

@@ -80,11 +80,18 @@ Navigate to [**Organization Settings** > **Workload Identity Federation**][6] an
 
 {{< img src="account_management/workload_identity_federation/identity-mappings-list.png" alt="Identity Mappings tab in the Workload Identity Federation page, showing the Org UUID field and a list of AWS ARN patterns mapped to Datadog users and service accounts" style="width:100%;" >}}
 
+<div class="alert alert-warning">Datadog requires the <strong>assumed-role ARN</strong> in the Source Pattern field, not the IAM role ARN. These two formats are different:</div>
+<ul>
+<li><strong>IAM role ARN</strong> (shown in the AWS Console): <code>arn:aws:iam::123456789012:role/my-role</code></li>
+<li><strong>Assumed-role ARN</strong> (required by Datadog): <code>arn:aws:sts::123456789012:assumed-role/my-role/session-name</code></li>
+</ul>
+To find the assumed-role ARN for your workload, run <code>aws sts get-caller-identity</code> from your workload environment and use the value in the <code>Arn</code> field of the response.
+
 To create an identity mapping:
 
 1. Click {{< ui >}}+ New Mapping{{< /ui >}}.
 2. Select a **Cloud Provider**.
-3. Enter a **Source Pattern (ARN)**. Use `*` for wildcard patterns (for example, `role/terraform-*`).
+3. Enter a **Source Pattern (ARN)**. Use the assumed-role ARN format and `*` for wildcard patterns (for example, `arn:aws:sts::123456789012:assumed-role/terraform-runner/*`).
 4. Search for and select a **Target Identity**. This is the Datadog user or service account this cloud identity authenticates as.
 5. Click {{< ui >}}Create Mapping{{< /ui >}}.
 
@@ -277,11 +284,18 @@ Navigate to [**Organization Settings** > **Workload Identity Federation**][6] an
 
 {{< img src="account_management/workload_identity_federation/intake-mappings-list.png" alt="Intake Mappings tab in the Workload Identity Federation page, showing the Org UUID field and a list of AWS ARN patterns authorized for Agent authentication" style="width:100%;" >}}
 
+<div class="alert alert-warning">Datadog requires the <strong>assumed-role ARN</strong> in the Source Pattern field, not the IAM role ARN. These two formats are different:</div>
+<ul>
+<li><strong>IAM role ARN</strong> (shown in the AWS Console): <code>arn:aws:iam::123456789012:role/my-role</code></li>
+<li><strong>Assumed-role ARN</strong> (required by Datadog): <code>arn:aws:sts::123456789012:assumed-role/my-role/session-name</code></li>
+</ul>
+To find the assumed-role ARN for your workload, run <code>aws sts get-caller-identity</code> from your workload environment and use the value in the <code>Arn</code> field of the response.
+
 To create an intake mapping:
 
 1. Click {{< ui >}}+ New Mapping{{< /ui >}}.
 2. Select a **Cloud Provider**.
-3. Enter a **Source Pattern (ARN)**. Use `*` for wildcard patterns (for example, `role/terraform-*`).
+3. Enter a **Source Pattern (ARN)**. Use the assumed-role ARN format and `*` for wildcard patterns (for example, `arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/*`).
 4. Click {{< ui >}}Create Mapping{{< /ui >}}.
 
 {{< img src="account_management/workload_identity_federation/intake-mapping-create.png" alt="Create Intake Mapping dialog with fields for Cloud Provider and Source Pattern ARN, with helper text describing wildcard pattern support" style="width:70%;" >}}