In our Filebeat AWS module documentation, location:
Docs: https://www.elastic.co/guide/en/beats/filebeat/7.12/filebeat-module-aws.html#_supported_formats_2
Source: https://github.com/elastic/beats/blob/master/x-pack/libbeat/docs/aws-credentials-config.asciidoc

please let's update this section:

 Use role_arn

If access_key_id and secret_access_key are not given, then {beatname_lc} will check for role_arn. role_arn is used to specify which AWS IAM role to assume for generating temporary credentials.

with a clarification:

Using role_arn also requires access key id and secret access key to be under the shared credential file [default] section. Please see Create Shared Credentials File for more details.
Access keys and secret access keys cannot be set in the configuration file alongside var.role_arn