AWS mwaa documentation change
Summary
Refined wording about service-linked role permissions and editing restrictions
Security assessment
Clarifies existing security posture but does not introduce new security features or address vulnerabilities. Emphasizes immutable role configuration as a security boundary.
Diff
diff --git a/mwaa/latest/userguide/mwaa-slr.md b/mwaa/latest/userguide/mwaa-slr.md index 3e17e1798..c60132c7b 100644 --- a//mwaa/latest/userguide/mwaa-slr.md +++ b//mwaa/latest/userguide/mwaa-slr.md @@ -11 +11 @@ Amazon Managed Workflows for Apache Airflow uses AWS Identity and Access Managem -A service-linked role makes setting up Amazon MWAA easier because you don’t have to manually add the necessary permissions. Amazon MWAA defines the permissions of its service-linked roles, and unless defined otherwise, only Amazon MWAA can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity. +A service-linked role makes setting up Amazon MWAA easier because you do not need to manually add the necessary permissions. Amazon MWAA defines the permissions of its service-linked roles, and unless defined otherwise, only Amazon MWAA can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity. @@ -172 +172 @@ If you delete this service-linked role, and then need to create it again, you ca -Amazon MWAA does not allow you to edit the AWSServiceRoleForAmazonMWAA service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, refer to [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_. +Amazon MWAA does not permit editing the AWSServiceRoleForAmazonMWAA service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, refer to [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the _IAM User Guide_.