Recently we added role-based authentication for our AWS template, and since then we have received multiple reports of users being confused of two things:

1. What is the IP address http://169.254.169.254/latest/meta-data/iam/security-credentials/, which can be found in the template. Some users believe it to be a placeholder, but it indeed is an internal AWS link used for authentication.

2. Because role-based authentication uses AWS internal resources, the Zabbix component (either Server or Proxy), that monitors AWS data, has to be hosted on AWS itself, otherwise you are unable to use role-based authentication.

I (alongside with other users and colleagues) feel like this should be documented to avoid further confusion.