AWS amazon-mq medium security documentation change
Summary
Reorganized plugin documentation structure, added explicit warnings about shovel plugin limitations with private brokers, clarified supported shovel types (dynamic only), and updated plugin references/links.
Security assessment
Added critical warning about not configuring shovel destinations to private brokers (security control to prevent unintended exposure). Updated OAuth 2.0/LDAP/AWS plugin documentation with clearer security feature descriptions (authentication mechanisms and credential retrieval).
Diff
diff --git a/amazon-mq/latest/developer-guide/rabbitmq-basic-elements-plugins.md b/amazon-mq/latest/developer-guide/rabbitmq-basic-elements-plugins.md index 6c074deb0..a56750a8c 100644 --- a//amazon-mq/latest/developer-guide/rabbitmq-basic-elements-plugins.md +++ b//amazon-mq/latest/developer-guide/rabbitmq-basic-elements-plugins.md @@ -5 +5 @@ -Shovel pluginFederation pluginConsistent Hash exchange pluginOAuth 2.0 pluginLDAP pluginaws plugin +RabbitMQ management pluginShovel pluginFederation pluginConsistent Hash exchange pluginOAuth 2.0 pluginLDAP pluginaws plugin @@ -7 +7 @@ Shovel pluginFederation pluginConsistent Hash exchange pluginOAuth 2.0 pluginLDA -# Plugins for Amazon MQ for RabbitMQ +# Plugins @@ -9 +9 @@ Shovel pluginFederation pluginConsistent Hash exchange pluginOAuth 2.0 pluginLDA -Amazon MQ for RabbitMQ supports the [RabbitMQ management plugin](https://www.rabbitmq.com/management.html) which powers the management API and the RabbitMQ web console. You can use the web console and the management API to create and manage broker users and policies. +Amazon MQ for RabbitMQ also supports the following plugins. @@ -11,3 +11 @@ Amazon MQ for RabbitMQ supports the [RabbitMQ management plugin](https://www.rab -In addition to the management plugin, Amazon MQ for RabbitMQ also supports the following plugins. - -###### Topics + * RabbitMQ management plugin @@ -21 +19 @@ In addition to the management plugin, Amazon MQ for RabbitMQ also supports the f - * OAuth 2.0 plugin + * OAuth 2 plugin @@ -29,0 +28,4 @@ In addition to the management plugin, Amazon MQ for RabbitMQ also supports the f +## RabbitMQ management plugin + +Amazon MQ for RabbitMQ supports the [RabbitMQ management plugin](https://www.rabbitmq.com/management.html), which provides an HTTP-based management API along with a browser based UI for the RabbitMQ web console. You can use the web console and the management API to create and manage broker users and policies. + @@ -32 +34,5 @@ In addition to the management plugin, Amazon MQ for RabbitMQ also supports the f -Amazon MQ managed brokers support [RabbitMQ shovel](https://www.rabbitmq.com/shovel.html), allowing you to move messages from queues and exchanges on one broker instance to another. You can use shovel to connect loosely coupled brokers and distribute messages away from nodes with heavier message loads. +Amazon MQ for RabbitMQ supports the [RabbitMQ shovel plugin](https://www.rabbitmq.com/shovel.html), which allows you to move messages from queues and exchanges on one broker to another. You can use shovel to connect loosely coupled brokers and distribute messages away from nodes with heavier message loads. + +###### Important + +You cannot configure shovel between queues or exchanges if the shovel destination is a private broker. @@ -34 +40,3 @@ Amazon MQ managed brokers support [RabbitMQ shovel](https://www.rabbitmq.com/sho -Amazon MQ managed RabbitMQ brokers support dynamic shovels. Dynamic shovels are configured using runtime parameters, and can be started and stopped at any time programatically by a client connection. For example, using the RabbitMQ management API, you can create a `PUT` request to the following API endpoint to configure a dynamic shovel. In the example, `{vhost}` can be replaced by the name of the broker's vhost, and `{name}` replaced by the name of the new dynamic shovel. +Amazon MQ does not support using static shovels. + +Only [dynamic shovels](https://www.rabbitmq.com/shovel-dynamic.html) are supported. Dynamic shovels are configured using runtime parameters and can be started and stopped at any time programmatically by a client connection. For example, using the RabbitMQ management API, you can create a PUT request to the following API endpoint to configure a dynamic shovel. In the example, {vhost} can be replaced by the name of the broker's vhost, and {name} replaced by the name of the new dynamic shovel. @@ -39 +47 @@ Amazon MQ managed RabbitMQ brokers support dynamic shovels. Dynamic shovels are -In the request body, you must specify either a queue or an exchange but not both. This example below configures a dynamic shovel between a local queue specified in `src-queue` and a remote queue defined in `dest-queue`. Similairly, you can use `src-exchange` and `dest-exchange` parameters to configure a shovel between two exchanges. +In the request body, you must specify either a queue or an exchange but not both. This example below configures a dynamic shovel between a local queue specified in src-queue and a remote queue defined in dest-queue. Similarly, you can use src-exchange and dest-exchange parameters to configure a shovel between two exchanges. @@ -48 +56 @@ In the request body, you must specify either a queue or an exchange but not both - "dest-uri": "amqps://b-c8352341-ec91-4a78-ad9c-a43f23d325bb.mq.us-west-2.amazonaws.com:5671", + "dest-uri": "amqps://b-c8352341-ec91-4a78-ad9c-a43f23d325bb.mq.us-west2.amazonaws.com:5671", @@ -53,10 +60,0 @@ In the request body, you must specify either a queue or an exchange but not both -###### Important - -You cannot configure shovel between queues or exchanges if the shovel destination is a private broker. - -For more information about using dynamic shovels, see [RabbitMQ dynamic shovel plugin](https://www.rabbitmq.com/shovel-dynamic.html). - -###### Note - -Amazon MQ does not support using static shovels. - @@ -65 +63 @@ Amazon MQ does not support using static shovels. -Amazon MQ supports federated exchanges and queues. With federation, you can replicate the flow of messages between queues, exchanges and consumers on separate brokers. Federated queues and exchanges use point-to-point links to connect to peers in other brokers. While federated exchanges, by default, route messages once, federated queues can move messages any number of times as needed by consumers. +Amazon MQ supports federated exchanges and queues using the [RabbitMQ federation plugin](https://www.rabbitmq.com/federation.html). With federation, you can replicate the flow of messages between queues, exchanges and consumers on separate brokers. Federated queues and exchanges use point-to-point links to connect to peers in other brokers. While federated exchanges, by default, route messages once, federated queues can move messages any number of times as needed by consumers. @@ -67 +65 @@ Amazon MQ supports federated exchanges and queues. With federation, you can repl -You can use federation to allow a _downstream_ broker to consume a message from an exchange or a queue on an _upstream_. You can enable federation on downstream brokers by using the RabbitMQ web console or the management API. +You can use federation to allow a downstream broker to consume a message from an exchange or a queue on an upstream. You can enable federation on downstream brokers by using the RabbitMQ web console or the management API. @@ -75 +73 @@ For example, using the management API, you can configure federation by doing the - * Configure one or more upstreams that define federation connections to other nodes. You can define federation connections by using the RabbitMQ web console or the management API. Using the management API, you can create a `POST` request to `/api/parameters/federation-upstream/%2f/`my-upstream`` with the following request body. + * Configure one or more upstreams that define federation connections to other nodes. You can define federation connections by using the RabbitMQ web console or the management API. Using the management API, you can create a POST request to /api/parameters/federation-upstream/%2f/myupstream with the following request body. @@ -79 +77 @@ For example, using the management API, you can configure federation by doing the - * Configure a policy to enable your queues or exchanges to become federated. You can configure policies by using the RabbitMQ web console, or the management API. Using the management API, you can create a `POST` request to `/api/policies/%2f/federate-me` with the following request body. + * Configure a policy to enable your queues or exchanges to become federated. You can configure policies by using the RabbitMQ web console, or the management API. Using the management API, you can create a POST request to /api/policies/%2f/federate-me with the following request body. @@ -85 +83 @@ For example, using the management API, you can configure federation by doing the -The request body assumes exchanges on the server are named beginning with `amq`. Using regular expression `^amq\.` will ensure that federation is enabled for all exchanges whose names begin with "amq." The exchanges on your RabbitMQ server can be named differently. +The request body assumes exchanges on the server are named beginning with amq. Using regular expression ^amq\\. will ensure that federation is enabled for all exchanges whose names begin with "amq." The exchanges on your RabbitMQ server can be named differently. @@ -90,2 +87,0 @@ The request body assumes exchanges on the server are named beginning with `amq`. -For more information about configuring the federation plugin, see [RabbitMQ federation plugin](https://www.rabbitmq.com/federation.html). - @@ -94,3 +90 @@ For more information about configuring the federation plugin, see [RabbitMQ fede -By default, Amazon MQ for RabbitMQ supports the Consistent Hash exchange type plugin. Consistent Hash exchanges route messages to queues based on a hash value calculated from the _routing key_ of a message. Given a reasonably even routing key, Consistent Hash exchanges can distribute messages between queues reasonably evenly. - -For queues bound to a Consistent Hash exchange, the binding key is a number-as-a-string that determines the _binding weight_ of each queue. Queues with a higher binding weight will receive a proportionally higher distribution of messages from the Consistent Hash exchange to which they are bound. In a Consistent Hash exchange topology, publishers can simply publish messages to the exchange, but consumers must be explicitly configured to consume messages from specific queues. +Amazon MQ for RabbitMQ supports the [RabbitMQ Consistent Hash Exchange Type plugin](https://github.com/rabbitmq/rabbitmq-consistent-hash-exchange). Consistent Hash exchanges route messages to queues based on a hash value calculated from the routing key of a message. Given a reasonably even routing key, Consistent Hash exchanges can distribute messages between queues reasonably evenly. @@ -98 +92 @@ For queues bound to a Consistent Hash exchange, the binding key is a number-as-a -For more information about Consistent Hash exchanges, see [RabbitMQ Consistent Hash Exchange Type](https://github.com/rabbitmq/rabbitmq-server/tree/master/deps/rabbitmq_consistent_hash_exchange) on the GitHub website. +For queues bound to a Consistent Hash exchange, the binding key is a number-as-a-string that determines the binding weight of each queue. Queues with a higher binding weight will receive a proportionally higher distribution of messages from the Consistent Hash exchange to which they are bound. In a Consistent Hash exchange topology, publishers can simply publish messages to the exchange, but consumers must be explicitly configured to consume messages from specific queues. @@ -102 +96 @@ For more information about Consistent Hash exchanges, see [RabbitMQ Consistent H -The [RabbitMQ OAuth 2.0 plugin](https://www.rabbitmq.com/docs/oauth2) is conditionally enabled by Amazon MQ for RabbitMQ based on your broker configuration. When enabled, this plugin provides OAuth 2.0 authentication and authorization with integration to external OAuth 2.0 identity providers for centralized user management and access control. For more information about OAuth 2.0 authentication, see [OAuth 2.0 authentication and authorization for Amazon MQ for RabbitMQ](./oauth-for-amq-for-rabbitmq.html). +Amazon MQ for RabbitMQ supports the [OAuth 2 authentication backend plugin](https://github.com/rabbitmq/rabbitmq-auth-backend-oauth2). This plugin is conditionally enabled based on your broker configuration. When enabled, this plugin provides OAuth 2.0 authentication and authorization with integration to external OAuth 2.0 identity providers for centralized user management and access control. For more information about OAuth 2.0 authentication, see [OAuth 2.0 authentication and authorization](./oauth-for-amq-for-rabbitmq.html). @@ -106 +100 @@ The [RabbitMQ OAuth 2.0 plugin](https://www.rabbitmq.com/docs/oauth2) is conditi -The [RabbitMQ LDAP plugin](https://www.rabbitmq.com/docs/ldap) is conditionally enabled by Amazon MQ for RabbitMQ based on your broker configuration. When enabled, this plugin provides LDAP authentication and authorization with integration to external LDAP directory services for centralized user authentication and authorization. For more information about LDAP authentication, see [LDAP authentication and authorization for Amazon MQ for RabbitMQ](./ldap-for-amq-for-rabbitmq.html). +Amazon MQ for RabbitMQ supports the [LDAP authentication backend plugin](https://github.com/rabbitmq/rabbitmq-auth-backend-ldap). This plugin is conditionally enabled based on your broker configuration. When enabled, this plugin provides LDAP authentication and authorization with integration to external LDAP directory services for centralized user authentication and authorization. For more information about LDAP authentication, see [LDAP authentication and authorization](./ldap-for-amq-for-rabbitmq.html). @@ -110 +104 @@ The [RabbitMQ LDAP plugin](https://www.rabbitmq.com/docs/ldap) is conditionally -The [aws plugin](https://github.com/amazon-mq/rabbitmq-aws) is conditionally enabled by Amazon MQ for RabbitMQ based on your broker configuration. This community plugin, developed and maintained by Amazon MQ, provides secure retrieval of credentials and certificates from AWS services using AWS ARNs in RabbitMQ configuration settings. For more information about ARN support, see [ARN support in RabbitMQ configuration](./arn-support-rabbitmq-configuration.html). +The [aws plugin](https://github.com/rabbitmq/rabbitmq-aws) is conditionally enabled by Amazon MQ for RabbitMQ based on your broker configuration. This community plugin, developed and maintained by Amazon MQ, provides secure retrieval of credentials and certificates from AWS services using AWS ARNs in RabbitMQ configuration settings. For more information about ARN support, see [ARN support in RabbitMQ configuration](./arn-support-rabbitmq-configuration.html). @@ -118 +112 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Sizing guidelines +OAuth 2.0 authentication and authorization @@ -120 +114 @@ Sizing guidelines -Policies +Protocols