AWS mwaa medium security documentation change
Summary
Updated phrasing from 'see' to 'refer to' in multiple links and documentation about EKS role ARN subpath issues
Security assessment
The change documents a known authentication issue with IAM role ARNs containing subpaths when integrating MWAA with EKS. While not fixing a vulnerability, it adds security-relevant documentation about proper role configuration to prevent authentication failures that could lead to access control issues.
Diff
diff --git a/mwaa/latest/userguide/mwaa-eks-example.md b/mwaa/latest/userguide/mwaa-eks-example.md index f015235a9..2ccc931f5 100644 --- a//mwaa/latest/userguide/mwaa-eks-example.md +++ b//mwaa/latest/userguide/mwaa-eks-example.md @@ -60 +60 @@ To use the example in this topic, you'll need the following: - * eksctl. To learn more, see [Install eksctl](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html#install-eksctl). + * eksctl. To learn more, refer to [Install eksctl](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-eksctl.html#install-eksctl). @@ -62 +62 @@ To use the example in this topic, you'll need the following: - * kubectl. To learn more, see [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/). In some case this is installed with eksctl. + * kubectl. To learn more, refer to [Install and Set Up kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/). In some case this is installed with eksctl. @@ -64 +64 @@ To use the example in this topic, you'll need the following: - * An EC2 key pair in the Region where you create your Amazon MWAA environment. To learn more, see [Creating or importing a key pair](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#prepare-key-pair). + * An EC2 key pair in the Region where you create your Amazon MWAA environment. To learn more, refer to [Creating or importing a key pair](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#prepare-key-pair). @@ -80 +80 @@ Use the following command to create a public key from your private key pair. -To learn more, see [Retrieving the public key for your key pair](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#retrieving-the-public-key). +To learn more, refer to [Retrieving the public key for your key pair](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#retrieving-the-public-key). @@ -280 +280 @@ After you create role, edit your Amazon MWAA environment to use the role you cre - * There is a known issue with role ARNs with subpaths not being able to authenticate with Amazon EKS. The workaround for this is to create the service role manually rather than using the one created by Amazon MWAA itself. To learn more, see [Roles with paths do not work when the path is included in their ARN in the aws-auth configmap](https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/268) + * There is a known issue with role ARNs with subpaths not being able to authenticate with Amazon EKS. The workaround for this is to create the service role manually rather than using the one created by Amazon MWAA itself. To learn more, refer to [Roles with paths do not work when the path is included in their ARN in the aws-auth configmap](https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/268) @@ -307 +307 @@ JSON -To learn more, see [How to use trust policies with IAM roles](https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/). +To learn more, refer to [How to use trust policies with IAM roles](https://aws.amazon.com/blogs/security/how-to-use-trust-policies-with-iam-roles/).