From ddbd32590cf7bda48306ea99378f6d08d8b1b826 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 11:59:50 -0700
Subject: [PATCH 01/18] Validate an clarify some minor points. add review date

---
 .../components/remote/remote.http.md          | 28 ++++++++++---------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.http.md b/docs/sources/reference/components/remote/remote.http.md
index 25075c83418..827453e2d36 100644
--- a/docs/sources/reference/components/remote/remote.http.md
+++ b/docs/sources/reference/components/remote/remote.http.md
@@ -7,6 +7,7 @@ labels:
   stage: general-availability
   products:
     - oss
+review_date: 2026-09-11
 title: remote.http
 ---
 
@@ -31,17 +32,18 @@ remote.http "<LABEL>" {
 
 You can use the following arguments with `remote.http`:
 
-| Name             | Type          | Description                                                  | Default | Required |
-| ---------------- | ------------- | ------------------------------------------------------------ | ------- | -------- |
-| `url`            | `string`      | URL to poll.                                                 |         | yes      |
-| `body`           | `string`      | The request body.                                            | `""`    | no       |
-| `headers`        | `map(string)` | Custom headers for the request.                              | `{}`    | no       |
-| `is_secret`      | `bool`        | Whether the response body should be treated as a [secret][]. | `false` | no       |
-| `method`         | `string`      | Define HTTP method for the request                           | `"GET"` | no       |
-| `poll_frequency` | `duration`    | Frequency to poll the URL.                                   | `"1m"`  | no       |
-| `poll_timeout`   | `duration`    | Timeout when polling the URL.                                | `"10s"` | no       |
-
-When `remote.http` performs a poll operation, an HTTP `GET` request is made against the URL specified by the `url` argument.
+| Name             | Type          | Description                                                       | Default | Required |
+| ---------------- | ------------- | ----------------------------------------------------------------- | ------- | -------- |
+| `url`            | `string`      | URL to poll.                                                      |         | yes      |
+| `body`           | `string`      | The request body.                                                 | `""`    | no       |
+| `headers`        | `map(string)` | Custom headers for the request.                                   | `{}`    | no       |
+| `is_secret`      | `bool`        | Whether the response body should be treated as a [secret][].      | `false` | no       |
+| `method`         | `string`      | The HTTP method for the request.                                  | `"GET"` | no       |
+| `poll_frequency` | `duration`    | Frequency to poll the URL.                                        | `"1m"`  | no       |
+| `poll_timeout`   | `duration`    | Timeout when polling the URL. Must be less than `poll_frequency`. | `"10s"` | no       |
+
+When `remote.http` performs a poll operation, an HTTP request using the method specified by the `method` argument is made against the URL specified by the `url` argument.
+If the `headers` argument doesn't set a `User-Agent` header, `remote.http` sends a default `User-Agent` header.
 A poll is triggered by the following:
 
 * When the component first loads.
@@ -52,7 +54,7 @@ The poll is successful if the URL returns a `200 OK` response code.
 All other response codes are treated as errors and mark the component as unhealthy.
 After a successful poll, the response body from the URL is exported.
 
-[secret]: ../../../../get-started/configuration-syntax/expressions/types_and_values/#secrets
+[secret]: ../../../../get-started/expressions/types_and_values/#secrets
 
 ## Blocks
 
@@ -119,7 +121,7 @@ If the `is_secret` argument was `true`, `content` is a secret type.
 
 ## Component health
 
-Instances of `remote.http` report as healthy if the most recent HTTP `GET` request of the specified URL succeeds.
+Instances of `remote.http` report as healthy if the most recent HTTP request of the specified URL succeeds.
 
 ## Debug information
 

From df2995db1fa0a2d56a6236b4a3205e39911df468 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 12:22:08 -0700
Subject: [PATCH 02/18] Validat and update configmap topic

---
 .../remote/remote.kubernetes.configmap.md       | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.kubernetes.configmap.md b/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
index 03de94296d7..7363e009041 100644
--- a/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
+++ b/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
@@ -7,6 +7,7 @@ labels:
   stage: general-availability
   products:
     - oss
+review_date: 2026-09-11
 title: remote.kubernetes.configmap
 ---
 
@@ -79,8 +80,8 @@ The following arguments are supported:
 | Name                     | Type                | Description                                                                                      | Default | Required |
 | ------------------------ | ------------------- | ------------------------------------------------------------------------------------------------ | ------- | -------- |
 | `api_server`             | `string`            | URL of the Kubernetes API server.                                                                |         | no       |
-| `bearer_token_file`      | `string`            | File containing a bearer token to authenticate with.                                             |         | no       |
 | `bearer_token`           | `secret`            | Bearer token to authenticate with.                                                               |         | no       |
+| `bearer_token_file`      | `string`            | File containing a bearer token to authenticate with.                                             |         | no       |
 | `enable_http2`           | `bool`              | Whether HTTP2 is supported for requests.                                                         | `true`  | no       |
 | `follow_redirects`       | `bool`              | Whether redirects returned by the server should be followed.                                     | `true`  | no       |
 | `http_headers`           | `map(list(secret))` | Custom HTTP headers to be sent along with each request. The map key is the header name.          |         | no       |
@@ -90,13 +91,13 @@ The following arguments are supported:
 | `proxy_from_environment` | `bool`              | Use the proxy URL indicated by environment variables.                                            | `false` | no       |
 | `proxy_url`              | `string`            | HTTP proxy to send requests through.                                                             |         | no       |
 
- At most, one of the following can be provided:
+At most, one of the following can be provided:
 
-* [`authorization`](#authorization) block
-* [`basic_auth`](#basic_auth) block
-* [`bearer_token_file`](#client) argument
-* [`bearer_token`](#client) argument
-* [`oauth2`](#oauth2) block
+- [`authorization`](#authorization) block
+- [`basic_auth`](#basic_auth) block
+- [`bearer_token_file`](#client) argument
+- [`bearer_token`](#client) argument
+- [`oauth2`](#oauth2) block
 
 {{< docs/shared lookup="reference/components/http-client-proxy-config-description.md" source="alloy" version="<ALLOY_VERSION>" >}}
 
@@ -128,7 +129,7 @@ The `data` field contains a mapping from field names to values.
 
 ## Component health
 
-Instances of `remote.kubernetes.configmap` report as healthy if the most recent attempt to poll the kubernetes API succeeds.
+Instances of `remote.kubernetes.configmap` report as healthy if the most recent attempt to poll the Kubernetes API succeeds.
 
 ## Debug information
 

From f6b4ac807d6cba7f8ecfde822fb068d21a2c1cf8 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 12:33:16 -0700
Subject: [PATCH 03/18] Fix table content

---
 docs/sources/reference/components/remote/remote.http.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.http.md b/docs/sources/reference/components/remote/remote.http.md
index 827453e2d36..822ee4a52e9 100644
--- a/docs/sources/reference/components/remote/remote.http.md
+++ b/docs/sources/reference/components/remote/remote.http.md
@@ -113,9 +113,9 @@ The `tls_config` block configures TLS settings for connecting to HTTPS servers.
 
 The following field is exported and can be referenced by other components:
 
-| Name      | Type                 | Description               | Default | Required |
-| --------- | -------------------- | ------------------------- | ------- | -------- |
-| `content` | `string` or `secret` | The contents of the file. |         | no       |
+| Name      | Type                 | Description                                                             |
+| --------- | -------------------- | ----------------------------------------------------------------------- |
+| `content` | `string` or `secret` | The contents of the response body from the most recent successful poll. |
 
 If the `is_secret` argument was `true`, `content` is a secret type.
 

From d242f2c7af08fb1b71063a4ca7b56dd05c73a6b2 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 12:53:12 -0700
Subject: [PATCH 04/18] Validata content, fix typos, formatting, fix example

---
 .../remote/remote.kubernetes.secret.md        | 31 ++++++++++---------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.kubernetes.secret.md b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
index 469906ce23f..4fb40c544dd 100644
--- a/docs/sources/reference/components/remote/remote.kubernetes.secret.md
+++ b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
@@ -7,6 +7,7 @@ labels:
   stage: general-availability
   products:
     - oss
+review_date: 2026-09-11
 title: remote.kubernetes.secret
 ---
 
@@ -39,9 +40,9 @@ You can use the following arguments with `remote.kubernetes.secret`:
 When this component performs a poll operation, it requests the Secret data from the Kubernetes API.
 A poll is triggered by the following:
 
-* When the component first loads.
-* Every time the component's arguments get re-evaluated.
-* At the frequency specified by the `poll_frequency` argument.
+- When the component first loads.
+- Every time the component's arguments get re-evaluated.
+- At the frequency specified by the `poll_frequency` argument.
 
 Any error while polling will mark the component as unhealthy.
 After a successful poll, all data is exported with the same field names as the source Secret.
@@ -79,24 +80,24 @@ The following arguments are supported:
 | Name                     | Type                | Description                                                                                      | Default | Required |
 | ------------------------ | ------------------- | ------------------------------------------------------------------------------------------------ | ------- | -------- |
 | `api_server`             | `string`            | URL of the Kubernetes API server.                                                                |         | no       |
-| `kubeconfig_file`        | `string`            | Path of the `kubeconfig` file to use for connecting to Kubernetes.                               |         | no       |
-| `bearer_token_file`      | `string`            | File containing a bearer token to authenticate with.                                             |         | no       |
 | `bearer_token`           | `secret`            | Bearer token to authenticate with.                                                               |         | no       |
+| `bearer_token_file`      | `string`            | File containing a bearer token to authenticate with.                                             |         | no       |
 | `enable_http2`           | `bool`              | Whether HTTP2 is supported for requests.                                                         | `true`  | no       |
 | `follow_redirects`       | `bool`              | Whether redirects returned by the server should be followed.                                     | `true`  | no       |
 | `http_headers`           | `map(list(secret))` | Custom HTTP headers to be sent along with each request. The map key is the header name.          |         | no       |
-| `proxy_url`              | `string`            | HTTP proxy to send requests through.                                                             |         | no       |
+| `kubeconfig_file`        | `string`            | Path of the `kubeconfig` file to use for connecting to Kubernetes.                               |         | no       |
 | `no_proxy`               | `string`            | Comma-separated list of IP addresses, CIDR notations, and domain names to exclude from proxying. |         | no       |
-| `proxy_from_environment` | `bool`              | Use the proxy URL indicated by environment variables.                                            | `false` | no       |
 | `proxy_connect_header`   | `map(list(secret))` | Specifies headers to send to proxies during CONNECT requests.                                    |         | no       |
+| `proxy_from_environment` | `bool`              | Use the proxy URL indicated by environment variables.                                            | `false` | no       |
+| `proxy_url`              | `string`            | HTTP proxy to send requests through.                                                             |         | no       |
 
- At most, one of the following can be provided:
+At most, one of the following can be provided:
 
-* [`authorization`](#authorization) block
-* [`basic_auth`](#basic_auth) block
-* [`bearer_token_file`](#client) argument
-* [`bearer_token`](#client) argument
-* [`oauth2`](#oauth2) block
+- [`authorization`](#authorization) block
+- [`basic_auth`](#basic_auth) block
+- [`bearer_token_file`](#client) argument
+- [`bearer_token`](#client) argument
+- [`oauth2`](#oauth2) block
 
 {{< docs/shared lookup="reference/components/http-client-proxy-config-description.md" source="alloy" version="<ALLOY_VERSION>" >}}
 
@@ -138,7 +139,7 @@ Using `convert.nonsensitive` allows for using the exports of `remote.kubernetes.
 
 ## Component health
 
-Instances of `remote.kubernetes.secret` report as healthy if the most recent attempt to poll the kubernetes API succeeds.
+Instances of `remote.kubernetes.secret` report as healthy if the most recent attempt to poll the Kubernetes API succeeds.
 
 ## Debug information
 
@@ -167,7 +168,7 @@ prometheus.remote_write "default" {
   endpoint {
     url = remote.kubernetes.configmap.endpoint.data["url"]
     basic_auth {
-      username = convert.nonsensitive(remote.kubernetes.configmap.endpoint.data["username"])
+      username = convert.nonsensitive(remote.kubernetes.secret.credentials.data["username"])
       password = remote.kubernetes.secret.credentials.data["password"]
     }
   }

From af60f2d7069862ce07a2b1149b825d2c5de8036e Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:00:29 -0700
Subject: [PATCH 05/18] Formatting cleanup and correct debug metrics section

---
 .../reference/components/remote/remote.s3.md  | 23 +++++++++++--------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.s3.md b/docs/sources/reference/components/remote/remote.s3.md
index 318161290f6..6a1416bb277 100644
--- a/docs/sources/reference/components/remote/remote.s3.md
+++ b/docs/sources/reference/components/remote/remote.s3.md
@@ -17,13 +17,13 @@ The file is polled for changes so that the most recent content is always availab
 
 The most common use of `remote.s3` is to load secrets from files.
 
-You can specify multiple `remote.s3` components by using different name labels.
+You can specify multiple `remote.s3` components by giving them different labels.
 By default, [AWS environment variables](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html) are used to authenticate against S3.
 The `key` and `secret` arguments inside `client` blocks can be used to provide custom authentication.
 
 {{< admonition type="note" >}}
-Other S3-compatible systems can be read  with `remote.s3` but may require specific authentication environment variables.
-There is no  guarantee that `remote.s3` will work with non-AWS S3 systems.
+Other S3-compatible systems can be read with `remote.s3` but may require specific authentication environment variables.
+There is no guarantee that `remote.s3` will work with non-AWS S3 systems.
 {{< /admonition >}}
 
 ## Usage
@@ -49,7 +49,7 @@ You can use the following arguments with `remote.s3`:
 This doesn't support reading of directories.
 {{< /admonition >}}
 
-[secret]: ../../../../get-started/configuration-syntax/expressions/types_and_values/#secrets
+[secret]: ../../../../get-started/expressions/types_and_values/#secrets
 
 ## Blocks
 
@@ -57,7 +57,7 @@ You can use the following block with `remote.s3`:
 
 {{< docs/alloy-config >}}
 
-| Name               | Description                                       | Required |
+| Block              | Description                                       | Required |
 | ------------------ | ------------------------------------------------- | -------- |
 | [`client`][client] | Additional options for configuring the S3 client. | no       |
 
@@ -83,9 +83,9 @@ The `client` block customizes options to connect to the S3 server.
 
 The following fields are exported and can be referenced by other components:
 
-| Name      | Type                 | Description               | Default | Required |
-| --------- | -------------------- | ------------------------- | ------- | -------- |
-| `content` | `string` or `secret` | The contents of the file. |         | no       |
+| Name      | Type                 | Description               |
+| --------- | -------------------- | -------------------------- |
+| `content` | `string` or `secret` | The contents of the file. |
 
 The `content` field will be secret if `is_secret` is set to true.
 
@@ -99,7 +99,12 @@ Instances of `remote.s3` report as healthy if the most recent read of the watche
 
 ## Debug metrics
 
-`remote.s3` doesn't expose any component-specific debug metrics.
+The following Prometheus metrics are exposed:
+
+| Name                                             | Type      | Description                                 |
+| ------------------------------------------------ | --------- | ------------------------------------------- |
+| `remote_s3_errors_total`                         | `counter` | The number of errors while accessing S3.    |
+| `remote_s3_timestamp_last_accessed_unix_seconds` | `gauge`   | The last successful access in Unix seconds. |
 
 ## Example
 

From abbccab9598042af802a34806b92c7dfdde78842 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:01:39 -0700
Subject: [PATCH 06/18] Add review date

---
 docs/sources/reference/components/remote/remote.s3.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/sources/reference/components/remote/remote.s3.md b/docs/sources/reference/components/remote/remote.s3.md
index 6a1416bb277..6950a2b653d 100644
--- a/docs/sources/reference/components/remote/remote.s3.md
+++ b/docs/sources/reference/components/remote/remote.s3.md
@@ -7,6 +7,7 @@ labels:
   stage: general-availability
   products:
     - oss
+review_date: 2026-09-11
 title: remote.s3
 ---
 

From 34f138970d97fa25fc42051e78c20f3b7d0d69a4 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:15:04 -0700
Subject: [PATCH 07/18] Validate content, fix typos, errors, tables

---
 .../components/remote/remote.vault.md         | 51 ++++++++++---------
 1 file changed, 27 insertions(+), 24 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.vault.md b/docs/sources/reference/components/remote/remote.vault.md
index b0bbf3e837c..2fb01bdcbd7 100644
--- a/docs/sources/reference/components/remote/remote.vault.md
+++ b/docs/sources/reference/components/remote/remote.vault.md
@@ -7,6 +7,7 @@ labels:
   stage: general-availability
   products:
     - oss
+review_date: 2026-09-11
 title: remote.vault
 ---
 
@@ -135,11 +136,11 @@ The `auth.azure` block authenticates to Vault using the [Azure auth method][Azur
 
 Credentials are retrieved for the running Azure VM using Managed Identities for Azure Resources.
 
-| Name           | Type     | Description                                          | Default   | Required |
-| -------------- | -------- | ---------------------------------------------------- | --------- | -------- |
-| `role`         | `string` | Role name to authenticate as.                        |           | yes      |
-| `resource_url` | `string` | Resource URL to include with authentication request. |           | no       |
-| `mount_path`   | `string` | Mount path for the login.                            | `"azure"` | no       |
+| Name           | Type     | Description                                          | Default                           | Required |
+| -------------- | -------- | ---------------------------------------------------- | --------------------------------- | -------- |
+| `role`         | `string` | Role name to authenticate as.                        |                                   | yes      |
+| `resource_url` | `string` | Resource URL to include with authentication request. | `"https://management.azure.com/"` | no       |
+| `mount_path`   | `string` | Mount path for the login.                            | `"azure"`                         | no       |
 
 [Azure]: https://www.vaultproject.io/docs/auth/azure
 
@@ -149,21 +150,21 @@ The `auth.custom` blocks allows authenticating against Vault using an arbitrary
 
 Using `auth.custom` is equivalent to calling `vault write PATH DATA` on the command line.
 
-
-| Name         | Type            | Description                                            | Default | Required |
-|--------------|-----------------|--------------------------------------------------------| ------- |----------|
-| `path`       | `string`        | Path to write to for creating an authentication token. |         | yes      |
-| `data`       | `map(secret)`   | Authentication data.                                   |         | yes      |
-| `namespace`  | `string`        | The namespace to authenticate to.                      |         | no       |
+| Name        | Type          | Description                                            | Default | Required |
+| ----------- | ------------- | ------------------------------------------------------ | ------- | -------- |
+| `path`      | `string`      | Path to write to for creating an authentication token. |         | yes      |
+| `data`      | `map(secret)` | Authentication data.                                   |         | yes      |
+| `namespace` | `string`      | The namespace to authenticate to.                      |         | no       |
 
 All values in the `data` attribute are considered secret, even if they contain nonsensitive information like usernames.
 
-With Vault Enterprise, you can authenticate against a parent namespace while storing secrets in a child namespace. 
+With Vault Enterprise, you can authenticate against a parent namespace while storing secrets in a child namespace.
 By specifying the namespace argument in `auth.custom`, you can authenticate to a namespace different from the one used to retrieve the secrets.
 
-You can also define Vault environment variables, which the clients used by {{< param "PRODUCT_NAME" >}} will automatically load. 
+You can also define Vault environment variables, which the clients used by {{< param "PRODUCT_NAME" >}} will automatically load.
 This approach allows you to use certificate-based authentication by setting the `VAULT_CACERT` and `VAULT_CAPATH` environment variables.
 Refer to the [Vault Environment variables](https://developer.hashicorp.com/vault/docs/commands#configure-environment-variables) documentation for more information.
+
 ### `auth.gcp`
 
 The `auth.gcp` block authenticates to Vault using the [GCP auth method][GCP].
@@ -186,11 +187,11 @@ When `type` is `"iam"`, the `iam_service_account` argument determines what servi
 
 The `auth.kubernetes` block authenticates to Vault using the [Kubernetes auth method][Kubernetes].
 
-| Name                   | Type     | Description                                 | Default        | Required |
-| ---------------------- | -------- | ------------------------------------------- | -------------- | -------- |
-| `role`                 | `string` | Role name to authenticate as.               |                | yes      |
-| `service_account_file` | `string` | Override service account token file to use. |                | no       |
-| `mount_path`           | `string` | Mount path for the login.                   | `"kubernetes"` | no       |
+| Name                   | Type     | Description                                 | Default                                                 | Required |
+| ---------------------- | -------- | ------------------------------------------- | ------------------------------------------------------- | -------- |
+| `role`                 | `string` | Role name to authenticate as.               |                                                         | yes      |
+| `service_account_file` | `string` | Override service account token file to use. | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` | no       |
+| `mount_path`           | `string` | Mount path for the login.                   | `"kubernetes"`                                          | no       |
 
 When `service_account_file` is not specified, the JWT token to authenticate with is retrieved from `/var/run/secrets/kubernetes.io/serviceaccount/token`.
 
@@ -291,10 +292,12 @@ Using `convert.nonsensitive` allows for using the exports of `remote.vault` for
 
 `remote.vault` exposes the following metrics:
 
-* `remote_vault_auth_total` (counter): Total number of times the component authenticated to Vault.
-* `remote_vault_secret_reads_total` (counter): Total number of times the secret was read from Vault.
-* `remote_vault_auth_lease_renewal_total` (counter): Total number of times the component renewed its authentication token lease.
-* `remote_vault_secret_lease_renewal_total` (counter): Total number of times the component renewed its secret token lease.
+| Name                                      | Type      | Description                                                                 |
+| ----------------------------------------- | --------- | --------------------------------------------------------------------------- |
+| `remote_vault_auth_total`                 | `counter` | Total number of times the component authenticated to Vault.                 |
+| `remote_vault_secret_reads_total`         | `counter` | Total number of times the secret was read from Vault.                       |
+| `remote_vault_auth_lease_renewal_total`   | `counter` | Total number of times the component renewed its authentication token lease. |
+| `remote_vault_secret_lease_renewal_total` | `counter` | Total number of times the component renewed its secret lease.               |
 
 ## Example
 
@@ -314,8 +317,8 @@ remote.vault "remote_write" {
   }
 }
 
-metrics.remote_write "prod" {
-  remote_write {
+prometheus.remote_write "prod" {
+  endpoint {
     url = "https://onprem-mimir:9009/api/v1/push"
     basic_auth {
       username = remote.vault.remote_write.data.username

From ca4373bbbc4a78193ac512ac37e69af4e4e5841e Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:16:04 -0700
Subject: [PATCH 08/18] Table alignment

---
 docs/sources/reference/components/remote/remote.s3.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/sources/reference/components/remote/remote.s3.md b/docs/sources/reference/components/remote/remote.s3.md
index 6950a2b653d..1eebb0d3b6b 100644
--- a/docs/sources/reference/components/remote/remote.s3.md
+++ b/docs/sources/reference/components/remote/remote.s3.md
@@ -85,7 +85,7 @@ The `client` block customizes options to connect to the S3 server.
 The following fields are exported and can be referenced by other components:
 
 | Name      | Type                 | Description               |
-| --------- | -------------------- | -------------------------- |
+| --------- | -------------------- | ------------------------- |
 | `content` | `string` or `secret` | The contents of the file. |
 
 The `content` field will be secret if `is_secret` is set to true.

From 55b847b56ce06387fd64ea4755ee3748446dfc41 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:19:39 -0700
Subject: [PATCH 09/18] Improve index topic

---
 docs/sources/reference/components/remote/_index.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/docs/sources/reference/components/remote/_index.md b/docs/sources/reference/components/remote/_index.md
index cb34344dc38..c1e36fa7613 100644
--- a/docs/sources/reference/components/remote/_index.md
+++ b/docs/sources/reference/components/remote/_index.md
@@ -1,12 +1,18 @@
 ---
 canonical: https://grafana.com/docs/alloy/latest/reference/components/remote/
 description: Learn about the remote components in Grafana Alloy
+review_date: 2026-09-11
+labels:
+  products:
+    - oss
 title: remote
 weight: 100
 ---
 
 # `remote`
 
-This section contains reference documentation for the `remote` components.
+The `remote` components retrieve content from sources outside of your {{< param "PRODUCT_NAME" >}} configuration, such as files in object storage, secrets in HashiCorp Vault, and Kubernetes ConfigMaps and Secrets, and expose that content to other components.
+
+Use a `remote` component when a value your configuration depends on, for example, a credential or a list of scrape targets, is managed somewhere else and can change independently of your configuration.
 
 {{< section >}}

From 12687ac87dd40e3cd3989f151267d24c39983938 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:38:32 -0700
Subject: [PATCH 10/18] Fix for active voice

---
 .../reference/components/remote/remote.http.md | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.http.md b/docs/sources/reference/components/remote/remote.http.md
index 822ee4a52e9..e73bcdad26a 100644
--- a/docs/sources/reference/components/remote/remote.http.md
+++ b/docs/sources/reference/components/remote/remote.http.md
@@ -14,7 +14,7 @@ title: remote.http
 # `remote.http`
 
 `remote.http` exposes the response body of a URL to other components.
-The URL is polled for changes so that the most recent content is always available.
+`remote.http` polls the URL for changes, so the most recent content is always available.
 
 The most common use of `remote.http` is to load discovery targets from an HTTP server.
 
@@ -37,22 +37,22 @@ You can use the following arguments with `remote.http`:
 | `url`            | `string`      | URL to poll.                                                      |         | yes      |
 | `body`           | `string`      | The request body.                                                 | `""`    | no       |
 | `headers`        | `map(string)` | Custom headers for the request.                                   | `{}`    | no       |
-| `is_secret`      | `bool`        | Whether the response body should be treated as a [secret][].      | `false` | no       |
+| `is_secret`      | `bool`        | Whether to treat the response body as a [secret][].              | `false` | no       |
 | `method`         | `string`      | The HTTP method for the request.                                  | `"GET"` | no       |
 | `poll_frequency` | `duration`    | Frequency to poll the URL.                                        | `"1m"`  | no       |
 | `poll_timeout`   | `duration`    | Timeout when polling the URL. Must be less than `poll_frequency`. | `"10s"` | no       |
 
-When `remote.http` performs a poll operation, an HTTP request using the method specified by the `method` argument is made against the URL specified by the `url` argument.
+When `remote.http` performs a poll operation, it makes an HTTP request using the method specified by the `method` argument against the URL specified by the `url` argument.
 If the `headers` argument doesn't set a `User-Agent` header, `remote.http` sends a default `User-Agent` header.
-A poll is triggered by the following:
+The following triggers a poll:
 
-* When the component first loads.
-* Every time the component's arguments get re-evaluated.
-* At the frequency specified by the `poll_frequency` argument.
+- When the component first loads.
+- Every time the component's arguments get re-evaluated.
+- At the frequency specified by the `poll_frequency` argument.
 
 The poll is successful if the URL returns a `200 OK` response code.
-All other response codes are treated as errors and mark the component as unhealthy.
-After a successful poll, the response body from the URL is exported.
+`remote.http` treats all other response codes as errors and marks the component as unhealthy.
+After a successful poll, `remote.http` exports the response body from the URL.
 
 [secret]: ../../../../get-started/expressions/types_and_values/#secrets
 

From ae67ad399d89ae0535aa6399f8d6020df30576ef Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:42:34 -0700
Subject: [PATCH 11/18] Fix active voice

---
 .../remote/remote.kubernetes.configmap.md     | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.kubernetes.configmap.md b/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
index 7363e009041..96c1ae2ec26 100644
--- a/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
+++ b/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
@@ -38,14 +38,14 @@ You can use the following arguments with `remote.kubernetes.configmap`:
 | `poll_timeout`   | `duration` | Timeout when polling the Kubernetes API.               | `"15s"` | no       |
 
 When this component performs a poll operation, it requests the ConfigMap data from the Kubernetes API.
-A poll is triggered by the following:
+The following triggers a poll:
 
-* When the component first loads.
-* Every time the component's arguments get re-evaluated.
-* At the frequency specified by the `poll_frequency` argument.
+- When the component first loads.
+- Every time the component's arguments get re-evaluated.
+- At the frequency specified by the `poll_frequency` argument.
 
-Any error while polling will mark the component as unhealthy.
-After a successful poll, all data is exported with the same field names as the source ConfigMap.
+Any error while polling marks the component as unhealthy.
+After a successful poll, `remote.kubernetes.configmap` exports all data with the same field names as the source ConfigMap.
 
 ## Blocks
 
@@ -73,25 +73,25 @@ You can use the following blocks with `remote.kubernetes.configmap`:
 ### `client`
 
 The `client` block configures the Kubernetes client used to discover ConfigMaps.
-If the `client` block isn't provided, the default in-cluster configuration with the service account of the running {{< param "PRODUCT_NAME" >}} Pod is used.
+If the `client` block isn't provided, {{< param "PRODUCT_NAME" >}} uses the default in-cluster configuration with the service account of the running {{< param "PRODUCT_NAME" >}} Pod.
 
-The following arguments are supported:
+The `client` block supports the following arguments:
 
 | Name                     | Type                | Description                                                                                      | Default | Required |
 | ------------------------ | ------------------- | ------------------------------------------------------------------------------------------------ | ------- | -------- |
 | `api_server`             | `string`            | URL of the Kubernetes API server.                                                                |         | no       |
 | `bearer_token`           | `secret`            | Bearer token to authenticate with.                                                               |         | no       |
 | `bearer_token_file`      | `string`            | File containing a bearer token to authenticate with.                                             |         | no       |
-| `enable_http2`           | `bool`              | Whether HTTP2 is supported for requests.                                                         | `true`  | no       |
-| `follow_redirects`       | `bool`              | Whether redirects returned by the server should be followed.                                     | `true`  | no       |
-| `http_headers`           | `map(list(secret))` | Custom HTTP headers to be sent along with each request. The map key is the header name.          |         | no       |
+| `enable_http2`           | `bool`              | Whether the client supports HTTP2 for requests.                                                  | `true`  | no       |
+| `follow_redirects`       | `bool`              | Whether the client follows redirects returned by the server.                                     | `true`  | no       |
+| `http_headers`           | `map(list(secret))` | Custom HTTP headers to send along with each request. The map key is the header name.             |         | no       |
 | `kubeconfig_file`        | `string`            | Path of the `kubeconfig` file to use for connecting to Kubernetes.                               |         | no       |
 | `no_proxy`               | `string`            | Comma-separated list of IP addresses, CIDR notations, and domain names to exclude from proxying. |         | no       |
 | `proxy_connect_header`   | `map(list(secret))` | Specifies headers to send to proxies during CONNECT requests.                                    |         | no       |
 | `proxy_from_environment` | `bool`              | Use the proxy URL indicated by environment variables.                                            | `false` | no       |
 | `proxy_url`              | `string`            | HTTP proxy to send requests through.                                                             |         | no       |
 
-At most, one of the following can be provided:
+At most, you can provide one of the following:
 
 - [`authorization`](#authorization) block
 - [`basic_auth`](#basic_auth) block
@@ -165,4 +165,4 @@ prometheus.remote_write "default" {
 }
 ```
 
-This example assumes that the Secret and ConfigMap have already been created, and that the appropriate field names exist in their data.
+This example assumes that the Secret and ConfigMap already exist, and that the appropriate field names exist in their data.

From 5b4a4165de954370b6731cb71ff5a551541b5221 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:44:28 -0700
Subject: [PATCH 12/18] Fix active voice

---
 .../remote/remote.kubernetes.secret.md        | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.kubernetes.secret.md b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
index 4fb40c544dd..e695e73fbd0 100644
--- a/docs/sources/reference/components/remote/remote.kubernetes.secret.md
+++ b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
@@ -38,14 +38,14 @@ You can use the following arguments with `remote.kubernetes.secret`:
 | `poll_timeout`   | `duration` | Timeout when polling the Kubernetes API.            | `"15s"` | no       |
 
 When this component performs a poll operation, it requests the Secret data from the Kubernetes API.
-A poll is triggered by the following:
+The following triggers a poll:
 
 - When the component first loads.
 - Every time the component's arguments get re-evaluated.
 - At the frequency specified by the `poll_frequency` argument.
 
-Any error while polling will mark the component as unhealthy.
-After a successful poll, all data is exported with the same field names as the source Secret.
+Any error while polling marks the component as unhealthy.
+After a successful poll, `remote.kubernetes.secret` exports all data with the same field names as the source Secret.
 
 ## Blocks
 
@@ -73,25 +73,25 @@ You can use the following blocks with `remote.kubernetes.secret`:
 ### `client`
 
 The `client` block configures the Kubernetes client used to discover Secrets.
-If the `client` block isn't provided, the default in-cluster configuration with the service account of the running {{< param "PRODUCT_NAME" >}} Pod is used.
+If the `client` block isn't provided, {{< param "PRODUCT_NAME" >}} uses the default in-cluster configuration with the service account of the running {{< param "PRODUCT_NAME" >}} Pod.
 
-The following arguments are supported:
+The `client` block supports the following arguments:
 
 | Name                     | Type                | Description                                                                                      | Default | Required |
 | ------------------------ | ------------------- | ------------------------------------------------------------------------------------------------ | ------- | -------- |
 | `api_server`             | `string`            | URL of the Kubernetes API server.                                                                |         | no       |
 | `bearer_token`           | `secret`            | Bearer token to authenticate with.                                                               |         | no       |
 | `bearer_token_file`      | `string`            | File containing a bearer token to authenticate with.                                             |         | no       |
-| `enable_http2`           | `bool`              | Whether HTTP2 is supported for requests.                                                         | `true`  | no       |
-| `follow_redirects`       | `bool`              | Whether redirects returned by the server should be followed.                                     | `true`  | no       |
-| `http_headers`           | `map(list(secret))` | Custom HTTP headers to be sent along with each request. The map key is the header name.          |         | no       |
+| `enable_http2`           | `bool`              | Whether the client supports HTTP2 for requests.                                                 | `true`  | no       |
+| `follow_redirects`       | `bool`              | Whether the client follows redirects returned by the server.                                    | `true`  | no       |
+| `http_headers`           | `map(list(secret))` | Custom HTTP headers to send along with each request. The map key is the header name.             |         | no       |
 | `kubeconfig_file`        | `string`            | Path of the `kubeconfig` file to use for connecting to Kubernetes.                               |         | no       |
 | `no_proxy`               | `string`            | Comma-separated list of IP addresses, CIDR notations, and domain names to exclude from proxying. |         | no       |
 | `proxy_connect_header`   | `map(list(secret))` | Specifies headers to send to proxies during CONNECT requests.                                    |         | no       |
 | `proxy_from_environment` | `bool`              | Use the proxy URL indicated by environment variables.                                            | `false` | no       |
 | `proxy_url`              | `string`            | HTTP proxy to send requests through.                                                             |         | no       |
 
-At most, one of the following can be provided:
+At most, you can provide one of the following:
 
 - [`authorization`](#authorization) block
 - [`basic_auth`](#basic_auth) block
@@ -127,7 +127,7 @@ The following fields are exported and can be referenced by other components:
 
 The `data` field contains a mapping from field names to values.
 
-If an individual key stored in `data` doesn't hold sensitive data, it can be converted into a string using [the `convert.nonsensitive` function][convert]:
+If an individual key stored in `data` doesn't hold sensitive data, you can convert it into a string using [the `convert.nonsensitive` function][convert]:
 
 ```alloy
 convert.nonsensitive(remote.kubernetes.secret.LABEL.data.KEY_NAME)
@@ -175,4 +175,4 @@ prometheus.remote_write "default" {
 }
 ```
 
-This example assumes that the Secret and ConfigMap have already been created, and that the appropriate field names exist in their data.
+This example assumes that the Secret and ConfigMap already exist, and that the appropriate field names exist in their data.

From 0c4e35b5088f9c5e718d3d35bdffb96cce59dd49 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:46:40 -0700
Subject: [PATCH 13/18] Fix passive voice

---
 .../reference/components/remote/remote.s3.md       | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.s3.md b/docs/sources/reference/components/remote/remote.s3.md
index 1eebb0d3b6b..c213119d4c0 100644
--- a/docs/sources/reference/components/remote/remote.s3.md
+++ b/docs/sources/reference/components/remote/remote.s3.md
@@ -14,17 +14,17 @@ title: remote.s3
 # `remote.s3`
 
 `remote.s3` exposes the string contents of a file located in [AWS S3](https://aws.amazon.com/s3/) to other components.
-The file is polled for changes so that the most recent content is always available.
+`remote.s3` polls the file for changes, so the most recent content is always available.
 
 The most common use of `remote.s3` is to load secrets from files.
 
 You can specify multiple `remote.s3` components by giving them different labels.
-By default, [AWS environment variables](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html) are used to authenticate against S3.
-The `key` and `secret` arguments inside `client` blocks can be used to provide custom authentication.
+By default, `remote.s3` uses [AWS environment variables](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html) to authenticate against S3.
+Use the `key` and `secret` arguments inside `client` blocks to provide custom authentication.
 
 {{< admonition type="note" >}}
-Other S3-compatible systems can be read with `remote.s3` but may require specific authentication environment variables.
-There is no guarantee that `remote.s3` will work with non-AWS S3 systems.
+`remote.s3` can read other S3-compatible systems, but they may require specific authentication environment variables.
+`remote.s3` isn't guaranteed to work with non-AWS S3 systems.
 {{< /admonition >}}
 
 ## Usage
@@ -88,7 +88,7 @@ The following fields are exported and can be referenced by other components:
 | --------- | -------------------- | ------------------------- |
 | `content` | `string` or `secret` | The contents of the file. |
 
-The `content` field will be secret if `is_secret` is set to true.
+The `content` field is secret if `is_secret` is `true`.
 
 ## Component health
 
@@ -100,7 +100,7 @@ Instances of `remote.s3` report as healthy if the most recent read of the watche
 
 ## Debug metrics
 
-The following Prometheus metrics are exposed:
+`remote.s3` exposes the following metrics:
 
 | Name                                             | Type      | Description                                 |
 | ------------------------------------------------ | --------- | ------------------------------------------- |

From 765e13f210de46b926d311f78968b5f0db00254a Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Fri, 11 Sep 2026 13:52:50 -0700
Subject: [PATCH 14/18] Fix active voice

---
 .../components/remote/remote.vault.md         | 68 +++++++++----------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.vault.md b/docs/sources/reference/components/remote/remote.vault.md
index 2fb01bdcbd7..cf7946cba4b 100644
--- a/docs/sources/reference/components/remote/remote.vault.md
+++ b/docs/sources/reference/components/remote/remote.vault.md
@@ -40,19 +40,19 @@ remote.vault "<LABEL>" {
 
 You can use the following arguments with `remote.vault`:
 
-| Name               | Type       | Description                                                | Default | Required |
-| ------------------ | ---------- | ---------------------------------------------------------- | ------- | -------- |
-| `path`             | `string`   | The path to retrieve a secret from.                        |         | yes      |
-| `server`           | `string`   | The Vault server to connect to.                            |         | yes      |
-| `namespace`        | `string`   | The Vault namespace to connect to (Vault Enterprise only). |         | no       |
-| `key`              | `string`   | The key to retrieve a secret from.                         |         | no       |
-| `reread_frequency` | `duration` | Rate to re-read keys.                                      | `"0s"`  | no       |
+| Name               | Type       | Description                                   | Default | Required |
+| ------------------ | ---------- | --------------------------------------------- | ------- | -------- |
+| `path`             | `string`   | The path to retrieve a secret from.           |         | yes      |
+| `server`           | `string`   | The Vault server to connect to.               |         | yes      |
+| `namespace`        | `string`   | The Vault Enterprise namespace to connect to. |         | no       |
+| `key`              | `string`   | The key to retrieve a secret from.            |         | no       |
+| `reread_frequency` | `duration` | Rate to re-read keys.                         | `"0s"`  | no       |
 
 Tokens with a lease are automatically renewed roughly two-thirds through their lease duration.
 If the leased token isn't renewable, or renewing the lease fails, the token is re-read.
 
 All tokens, regardless of whether they have a lease, are automatically reread at a frequency specified by the `reread_frequency` argument.
-Setting `reread_frequency` to `"0s"` (the default) disables this behavior.
+The default value of `reread_frequency`, `"0s"`, disables this behavior.
 
 ## Blocks
 
@@ -86,7 +86,7 @@ You can use the following blocks with `remote.vault`:
 
 {{< /docs/alloy-config >}}
 
-Exactly one `auth.*` block **must** be provided, otherwise the component will fail to load.
+You must provide exactly one `auth.*` block, or the component fails to load.
 
 ### `auth.approle`
 
@@ -106,8 +106,8 @@ The `auth.approle` block authenticates to Vault using the [AppRole auth method][
 
 The `auth.aws` block authenticates to Vault using the [AWS auth method][AWS].
 
-Credentials used to connect to AWS are specified by the environment variables `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION`.
-The environment variable `AWS_SHARED_CREDENTIALS_FILE` may be specified to use a credentials file instead.
+The environment variables `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION` specify the credentials used to connect to AWS.
+You can specify the environment variable `AWS_SHARED_CREDENTIALS_FILE` to use a credentials file instead.
 
 | Name                   | Type     | Description                                       | Default       | Required |
 | ---------------------- | -------- | ------------------------------------------------- | ------------- | -------- |
@@ -118,15 +118,15 @@ The environment variable `AWS_SHARED_CREDENTIALS_FILE` may be specified to use a
 | `region`               | `string` | AWS region to connect to.                         | `"us-east-1"` | no       |
 | `role`                 | `string` | Overrides the inferred role name inferred.        | `""`          | no       |
 
-The `type` argument must be set to one of `"ec2"` or `"iam"`.
+Set the `type` argument to `"ec2"` or `"iam"`.
 
-The `iam_server_id_header` argument is required used when `type` is set to `"iam"`.
+You must set `iam_server_id_header` when `type` is `"iam"`.
 
-If the `region` argument is explicitly set to an empty string `""`, the region to connect to will be inferred using an API call to the EC2 metadata service.
+If you explicitly set the `region` argument to an empty string `""`, `remote.vault` infers the region using an API call to the EC2 metadata service.
 
 The `ec2_signature_type` argument configures the signature to use when authenticating against EC2.
-It only applies when `type` is set to `"ec2"`.
-`ec2_signature_type` must be set to either `"identity"` or `"pkcs7"`.
+It only applies when `type` is `"ec2"`.
+Set `ec2_signature_type` to `"identity"` or `"pkcs7"`.
 
 [AWS]: https://www.vaultproject.io/docs/auth/aws
 
@@ -134,7 +134,7 @@ It only applies when `type` is set to `"ec2"`.
 
 The `auth.azure` block authenticates to Vault using the [Azure auth method][Azure].
 
-Credentials are retrieved for the running Azure VM using Managed Identities for Azure Resources.
+`remote.vault` retrieves credentials for the running Azure VM using Managed Identities for Azure Resources.
 
 | Name           | Type     | Description                                          | Default                           | Required |
 | -------------- | -------- | ---------------------------------------------------- | --------------------------------- | -------- |
@@ -156,12 +156,12 @@ Using `auth.custom` is equivalent to calling `vault write PATH DATA` on the comm
 | `data`      | `map(secret)` | Authentication data.                                   |         | yes      |
 | `namespace` | `string`      | The namespace to authenticate to.                      |         | no       |
 
-All values in the `data` attribute are considered secret, even if they contain nonsensitive information like usernames.
+`remote.vault` considers all values in the `data` attribute secret, even if they contain nonsensitive information like usernames.
 
 With Vault Enterprise, you can authenticate against a parent namespace while storing secrets in a child namespace.
 By specifying the namespace argument in `auth.custom`, you can authenticate to a namespace different from the one used to retrieve the secrets.
 
-You can also define Vault environment variables, which the clients used by {{< param "PRODUCT_NAME" >}} will automatically load.
+You can also define Vault environment variables, which the clients used by {{< param "PRODUCT_NAME" >}} automatically load.
 This approach allows you to use certificate-based authentication by setting the `VAULT_CACERT` and `VAULT_CAPATH` environment variables.
 Refer to the [Vault Environment variables](https://developer.hashicorp.com/vault/docs/commands#configure-environment-variables) documentation for more information.
 
@@ -176,8 +176,8 @@ The `auth.gcp` block authenticates to Vault using the [GCP auth method][GCP].
 | `iam_service_account` | `string` | IAM service account name to use.           |         | no       |
 | `mount_path`          | `string` | Mount path for the login.                  | `"gcp"` | no       |
 
-The `type` argument must be set to `"gce"` or `"iam"`. When `type` is `"gce"`, credentials are retrieved using the metadata service on GCE VMs.
-When `type` is `"iam"`, credentials are retrieved from the file that the `GOOGLE_APPLICATION_CREDENTIALS` environment variable points to.
+Set the `type` argument to `"gce"` or `"iam"`. When `type` is `"gce"`, `remote.vault` retrieves credentials using the metadata service on GCE VMs.
+When `type` is `"iam"`, `remote.vault` retrieves credentials from the file that the `GOOGLE_APPLICATION_CREDENTIALS` environment variable points to.
 
 When `type` is `"iam"`, the `iam_service_account` argument determines what service account name to use.
 
@@ -193,7 +193,7 @@ The `auth.kubernetes` block authenticates to Vault using the [Kubernetes auth me
 | `service_account_file` | `string` | Override service account token file to use. | `"/var/run/secrets/kubernetes.io/serviceaccount/token"` | no       |
 | `mount_path`           | `string` | Mount path for the login.                   | `"kubernetes"`                                          | no       |
 
-When `service_account_file` is not specified, the JWT token to authenticate with is retrieved from `/var/run/secrets/kubernetes.io/serviceaccount/token`.
+When `service_account_file` isn't specified, `remote.vault` retrieves the JWT token to authenticate with from `/var/run/secrets/kubernetes.io/serviceaccount/token`.
 
 [Kubernetes]: https://www.vaultproject.io/docs/auth/kubernetes
 
@@ -240,14 +240,14 @@ The `client_options` block customizes the connection to vault.
 | `max_retries`    | `int`      | Maximum number of times to retry after a 5xx error.   | `2`        | no       |
 | `timeout`        | `duration` | Maximum time to wait before a request times out.      | `"60s"`    | no       |
 
-Requests which fail due to server errors (HTTP 5xx error codes) can be retried.
+`remote.vault` can retry requests that fail with an HTTP 5xx server error.
 The `max_retries` argument specifies how many times to retry failed requests.
 The `min_retry_wait` and `max_retry_wait` arguments specify how long to wait before retrying.
 The wait period starts at `min_retry_wait` and exponentially increases up to `max_retry_wait`.
 
 Other types of failed requests, including HTTP 4xx error codes, aren't retried.
 
-If the `max_retries` argument is set to `0`, failed requests aren't retried.
+If you set the `max_retries` argument to `0`, `remote.vault` doesn't retry failed requests.
 
 ## Exported fields
 
@@ -261,10 +261,10 @@ The `data` field contains a mapping from data field names to values.
 There is one mapping for each string-like field stored in the Vault secret.
 
 Vault permits secret engines to store arbitrary data within the key-value pairs for a secret.
-The `remote.vault` component is only able to use values which are strings or can be converted to strings.
-Keys with non-string values are ignored and omitted from the `data` field.
+The `remote.vault` component can only use values that are strings, or that it can convert to strings.
+`remote.vault` ignores and omits keys with non-string values from the `data` field.
 
-If an individual key stored in `data` doesn't hold sensitive data, it can be converted into a string using [the `nonsensitive` function][convert.nonsensitive]:
+If an individual key stored in `data` doesn't hold sensitive data, you can convert it into a string using [the `nonsensitive` function][convert.nonsensitive]:
 
 ```alloy
 convert.nonsensitive(remote.vault.LABEL.data.KEY_NAME)
@@ -276,17 +276,17 @@ Using `convert.nonsensitive` allows for using the exports of `remote.vault` for
 
 ## Component health
 
-`remote.vault` is reported as unhealthy if the latest reread or renewal of secrets was unsuccessful.
+`remote.vault` reports as unhealthy if the most recent reread or renewal of secrets was unsuccessful.
 
 ## Debug information
 
 `remote.vault` exposes debug information for the authentication token and secret around:
 
-* The latest request ID used for retrieving or renewing the token.
-* The most recent time when the token was retrieved or renewed.
-* The expiration time for the token (if applicable).
-* Whether the token is renewable.
-* Warnings from Vault from when the token was retrieved.
+- The most recent request ID used for retrieving or renewing the token.
+- The most recent time `remote.vault` retrieved or renewed the token.
+- The token's expiration time, if applicable.
+- Whether the token is renewable.
+- Warnings from Vault when it retrieved the token.
 
 ## Debug metrics
 
@@ -295,7 +295,7 @@ Using `convert.nonsensitive` allows for using the exports of `remote.vault` for
 | Name                                      | Type      | Description                                                                 |
 | ----------------------------------------- | --------- | --------------------------------------------------------------------------- |
 | `remote_vault_auth_total`                 | `counter` | Total number of times the component authenticated to Vault.                 |
-| `remote_vault_secret_reads_total`         | `counter` | Total number of times the secret was read from Vault.                       |
+| `remote_vault_secret_reads_total`         | `counter` | Total number of times `remote.vault` read the secret from Vault.            |
 | `remote_vault_auth_lease_renewal_total`   | `counter` | Total number of times the component renewed its authentication token lease. |
 | `remote_vault_secret_lease_renewal_total` | `counter` | Total number of times the component renewed its secret lease.               |
 

From 94d5a1994991b92062b0ac703066a816ff7bd44b Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Mon, 14 Sep 2026 09:49:21 -0700
Subject: [PATCH 15/18] Fix table alignment in markdown

---
 .../reference/components/remote/remote.kubernetes.secret.md   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.kubernetes.secret.md b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
index e695e73fbd0..4ba214fdde8 100644
--- a/docs/sources/reference/components/remote/remote.kubernetes.secret.md
+++ b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
@@ -82,8 +82,8 @@ The `client` block supports the following arguments:
 | `api_server`             | `string`            | URL of the Kubernetes API server.                                                                |         | no       |
 | `bearer_token`           | `secret`            | Bearer token to authenticate with.                                                               |         | no       |
 | `bearer_token_file`      | `string`            | File containing a bearer token to authenticate with.                                             |         | no       |
-| `enable_http2`           | `bool`              | Whether the client supports HTTP2 for requests.                                                 | `true`  | no       |
-| `follow_redirects`       | `bool`              | Whether the client follows redirects returned by the server.                                    | `true`  | no       |
+| `enable_http2`           | `bool`              | Whether the client supports HTTP2 for requests.                                                  | `true`  | no       |
+| `follow_redirects`       | `bool`              | Whether the client follows redirects returned by the server.                                     | `true`  | no       |
 | `http_headers`           | `map(list(secret))` | Custom HTTP headers to send along with each request. The map key is the header name.             |         | no       |
 | `kubeconfig_file`        | `string`            | Path of the `kubeconfig` file to use for connecting to Kubernetes.                               |         | no       |
 | `no_proxy`               | `string`            | Comma-separated list of IP addresses, CIDR notations, and domain names to exclude from proxying. |         | no       |

From acecc1a7099046ff4d8126a33148f8e4ededeba1 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Mon, 14 Sep 2026 11:17:09 -0700
Subject: [PATCH 16/18] Fix bad link and align headings

---
 docs/sources/reference/components/remote/remote.http.md       | 2 +-
 .../components/remote/remote.kubernetes.configmap.md          | 4 ++--
 .../reference/components/remote/remote.kubernetes.secret.md   | 4 ++--
 docs/sources/reference/components/remote/remote.s3.md         | 2 +-
 docs/sources/reference/components/remote/remote.vault.md      | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.http.md b/docs/sources/reference/components/remote/remote.http.md
index e73bcdad26a..407cae914d4 100644
--- a/docs/sources/reference/components/remote/remote.http.md
+++ b/docs/sources/reference/components/remote/remote.http.md
@@ -131,7 +131,7 @@ Instances of `remote.http` report as healthy if the most recent HTTP request of
 
 `remote.http` doesn't expose any component-specific debug metrics.
 
-## Example
+## Examples
 
 This example reads a JSON array of objects from an endpoint and uses them as a set of scrape targets:
 
diff --git a/docs/sources/reference/components/remote/remote.kubernetes.configmap.md b/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
index 96c1ae2ec26..a430b339067 100644
--- a/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
+++ b/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
@@ -94,7 +94,7 @@ The `client` block supports the following arguments:
 At most, you can provide one of the following:
 
 - [`authorization`](#authorization) block
-- [`basic_auth`](#basic_auth) block
+- [`basic_auth`](#basic-auth) block
 - [`bearer_token_file`](#client) argument
 - [`bearer_token`](#client) argument
 - [`oauth2`](#oauth2) block
@@ -139,7 +139,7 @@ Instances of `remote.kubernetes.configmap` report as healthy if the most recent
 
 `remote.kubernetes.configmap` doesn't expose any component-specific debug metrics.
 
-## Example
+## Examples
 
 This example reads a Secret and a ConfigMap from Kubernetes and uses them to supply remote-write credentials.
 
diff --git a/docs/sources/reference/components/remote/remote.kubernetes.secret.md b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
index 4ba214fdde8..d3741ed0252 100644
--- a/docs/sources/reference/components/remote/remote.kubernetes.secret.md
+++ b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
@@ -94,7 +94,7 @@ The `client` block supports the following arguments:
 At most, you can provide one of the following:
 
 - [`authorization`](#authorization) block
-- [`basic_auth`](#basic_auth) block
+- [`basic_auth`](#basic-auth) block
 - [`bearer_token_file`](#client) argument
 - [`bearer_token`](#client) argument
 - [`oauth2`](#oauth2) block
@@ -149,7 +149,7 @@ Instances of `remote.kubernetes.secret` report as healthy if the most recent att
 
 `remote.kubernetes.secret` doesn't expose any component-specific debug metrics.
 
-## Example
+## Examples
 
 This example reads a Secret and a ConfigMap from Kubernetes and uses them to supply remote-write credentials.
 
diff --git a/docs/sources/reference/components/remote/remote.s3.md b/docs/sources/reference/components/remote/remote.s3.md
index c213119d4c0..99365bdca5f 100644
--- a/docs/sources/reference/components/remote/remote.s3.md
+++ b/docs/sources/reference/components/remote/remote.s3.md
@@ -107,7 +107,7 @@ Instances of `remote.s3` report as healthy if the most recent read of the watche
 | `remote_s3_errors_total`                         | `counter` | The number of errors while accessing S3.    |
 | `remote_s3_timestamp_last_accessed_unix_seconds` | `gauge`   | The last successful access in Unix seconds. |
 
-## Example
+## Examples
 
 ```alloy
 remote.s3 "data" {
diff --git a/docs/sources/reference/components/remote/remote.vault.md b/docs/sources/reference/components/remote/remote.vault.md
index cf7946cba4b..dffe5a85223 100644
--- a/docs/sources/reference/components/remote/remote.vault.md
+++ b/docs/sources/reference/components/remote/remote.vault.md
@@ -299,7 +299,7 @@ Using `convert.nonsensitive` allows for using the exports of `remote.vault` for
 | `remote_vault_auth_lease_renewal_total`   | `counter` | Total number of times the component renewed its authentication token lease. |
 | `remote_vault_secret_lease_renewal_total` | `counter` | Total number of times the component renewed its secret lease.               |
 
-## Example
+## Examples
 
 ```alloy
 local.file "vault_token" {

From c68e6275c7e6704c37e2f1163bc4aded8e1365e9 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Mon, 14 Sep 2026 12:13:35 -0700
Subject: [PATCH 17/18] Fix markdown alignment for readability

---
 docs/sources/reference/components/remote/remote.http.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/sources/reference/components/remote/remote.http.md b/docs/sources/reference/components/remote/remote.http.md
index 407cae914d4..ec0d4d946c6 100644
--- a/docs/sources/reference/components/remote/remote.http.md
+++ b/docs/sources/reference/components/remote/remote.http.md
@@ -37,7 +37,7 @@ You can use the following arguments with `remote.http`:
 | `url`            | `string`      | URL to poll.                                                      |         | yes      |
 | `body`           | `string`      | The request body.                                                 | `""`    | no       |
 | `headers`        | `map(string)` | Custom headers for the request.                                   | `{}`    | no       |
-| `is_secret`      | `bool`        | Whether to treat the response body as a [secret][].              | `false` | no       |
+| `is_secret`      | `bool`        | Whether to treat the response body as a [secret][].               | `false` | no       |
 | `method`         | `string`      | The HTTP method for the request.                                  | `"GET"` | no       |
 | `poll_frequency` | `duration`    | Frequency to poll the URL.                                        | `"1m"`  | no       |
 | `poll_timeout`   | `duration`    | Timeout when polling the URL. Must be less than `poll_frequency`. | `"10s"` | no       |

From d9fa03f907704730123c58826fa8eccb4d2bffc7 Mon Sep 17 00:00:00 2001
From: Clayton Cornell <clayton.cornell@grafana.com>
Date: Tue, 15 Sep 2026 07:59:20 -0700
Subject: [PATCH 18/18] Fixes from CoPilot review

---
 .../remote/remote.kubernetes.configmap.md        |  2 +-
 .../remote/remote.kubernetes.secret.md           |  2 +-
 .../reference/components/remote/remote.vault.md  | 16 ++++++++--------
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/docs/sources/reference/components/remote/remote.kubernetes.configmap.md b/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
index a430b339067..5f58c188836 100644
--- a/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
+++ b/docs/sources/reference/components/remote/remote.kubernetes.configmap.md
@@ -94,7 +94,7 @@ The `client` block supports the following arguments:
 At most, you can provide one of the following:
 
 - [`authorization`](#authorization) block
-- [`basic_auth`](#basic-auth) block
+- [`basic_auth`](#basic_auth) block
 - [`bearer_token_file`](#client) argument
 - [`bearer_token`](#client) argument
 - [`oauth2`](#oauth2) block
diff --git a/docs/sources/reference/components/remote/remote.kubernetes.secret.md b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
index d3741ed0252..5126b046aa9 100644
--- a/docs/sources/reference/components/remote/remote.kubernetes.secret.md
+++ b/docs/sources/reference/components/remote/remote.kubernetes.secret.md
@@ -94,7 +94,7 @@ The `client` block supports the following arguments:
 At most, you can provide one of the following:
 
 - [`authorization`](#authorization) block
-- [`basic_auth`](#basic-auth) block
+- [`basic_auth`](#basic_auth) block
 - [`bearer_token_file`](#client) argument
 - [`bearer_token`](#client) argument
 - [`oauth2`](#oauth2) block
diff --git a/docs/sources/reference/components/remote/remote.vault.md b/docs/sources/reference/components/remote/remote.vault.md
index dffe5a85223..4b2ce80bfc3 100644
--- a/docs/sources/reference/components/remote/remote.vault.md
+++ b/docs/sources/reference/components/remote/remote.vault.md
@@ -51,7 +51,7 @@ You can use the following arguments with `remote.vault`:
 Tokens with a lease are automatically renewed roughly two-thirds through their lease duration.
 If the leased token isn't renewable, or renewing the lease fails, the token is re-read.
 
-All tokens, regardless of whether they have a lease, are automatically reread at a frequency specified by the `reread_frequency` argument.
+The retrieved secret is automatically reread at a frequency specified by the `reread_frequency` argument, regardless of whether it has a lease.
 The default value of `reread_frequency`, `"0s"`, disables this behavior.
 
 ## Blocks
@@ -106,7 +106,7 @@ The `auth.approle` block authenticates to Vault using the [AppRole auth method][
 
 The `auth.aws` block authenticates to Vault using the [AWS auth method][AWS].
 
-The environment variables `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION` specify the credentials used to connect to AWS.
+The environment variables `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` specify the credentials used to connect to AWS.
 You can specify the environment variable `AWS_SHARED_CREDENTIALS_FILE` to use a credentials file instead.
 
 | Name                   | Type     | Description                                       | Default       | Required |
@@ -116,11 +116,11 @@ You can specify the environment variable `AWS_SHARED_CREDENTIALS_FILE` to use a
 | `iam_server_id_header` | `string` | Configures a `X-Vault-AWS-IAM-Server-ID` header.  | `""`          | no       |
 | `mount_path`           | `string` | Mount path for the login.                         | `"aws"`       | no       |
 | `region`               | `string` | AWS region to connect to.                         | `"us-east-1"` | no       |
-| `role`                 | `string` | Overrides the inferred role name inferred.        | `""`          | no       |
+| `role`                 | `string` | Overrides the inferred role name.                 | `""`          | no       |
 
 Set the `type` argument to `"ec2"` or `"iam"`.
 
-You must set `iam_server_id_header` when `type` is `"iam"`.
+You can set `iam_server_id_header` when `type` is `"iam"`.
 
 If you explicitly set the `region` argument to an empty string `""`, `remote.vault` infers the region using an API call to the EC2 metadata service.
 
@@ -179,7 +179,7 @@ The `auth.gcp` block authenticates to Vault using the [GCP auth method][GCP].
 Set the `type` argument to `"gce"` or `"iam"`. When `type` is `"gce"`, `remote.vault` retrieves credentials using the metadata service on GCE VMs.
 When `type` is `"iam"`, `remote.vault` retrieves credentials from the file that the `GOOGLE_APPLICATION_CREDENTIALS` environment variable points to.
 
-When `type` is `"iam"`, the `iam_service_account` argument determines what service account name to use.
+When `type` is `"iam"`, you must set the `iam_service_account` argument to the service account name to use. `remote.vault` fails validation if `iam_service_account` isn't set when `type` is `"iam"`.
 
 [GCP]: https://www.vaultproject.io/docs/auth/gcp
 
@@ -261,8 +261,8 @@ The `data` field contains a mapping from data field names to values.
 There is one mapping for each string-like field stored in the Vault secret.
 
 Vault permits secret engines to store arbitrary data within the key-value pairs for a secret.
-The `remote.vault` component can only use values that are strings, or that it can convert to strings.
-`remote.vault` ignores and omits keys with non-string values from the `data` field.
+The `remote.vault` component can use values that are strings or byte slices.
+It ignores and omits keys with other value types from the `data` field.
 
 If an individual key stored in `data` doesn't hold sensitive data, you can convert it into a string using [the `nonsensitive` function][convert.nonsensitive]:
 
@@ -321,7 +321,7 @@ prometheus.remote_write "prod" {
   endpoint {
     url = "https://onprem-mimir:9009/api/v1/push"
     basic_auth {
-      username = remote.vault.remote_write.data.username
+      username = convert.nonsensitive(remote.vault.remote_write.data.username)
       password = remote.vault.remote_write.data.password
     }
   }