AWS amazon-mq documentation change
Summary
Added HTTP authentication ARN configurations and restructured LDAP security parameters
Security assessment
Documents secure certificate/key management for HTTP/LDAP authentication but doesn't fix a specific vulnerability
Diff
diff --git a/amazon-mq/latest/developer-guide/arn-support-rabbitmq-configuration.md b/amazon-mq/latest/developer-guide/arn-support-rabbitmq-configuration.md index fb34ce912..7bf3e3d56 100644 --- a//amazon-mq/latest/developer-guide/arn-support-rabbitmq-configuration.md +++ b//amazon-mq/latest/developer-guide/arn-support-rabbitmq-configuration.md @@ -43 +43 @@ Amazon MQ for RabbitMQ supports AWS ARNs for the values of some RabbitMQ configu -`aws.arns.auth_ldap.dn_lookup_bind.password` +###### Required IAM role @@ -44,0 +45 @@ Amazon MQ for RabbitMQ supports AWS ARNs for the values of some RabbitMQ configu +`aws.arns.assume_role_arn` @@ -46 +46,0 @@ Amazon MQ for RabbitMQ supports AWS ARNs for the values of some RabbitMQ configu -Amazon MQ requires using AWS Secrets Manager to store the password as a plaintext value @@ -48 +48 @@ Amazon MQ requires using AWS Secrets Manager to store the password as a plaintex -`aws.arns.auth_ldap.other_bind.password` +IAM role ARN that Amazon MQ assumes to access other AWS resources. Required when any other ARN configuration is used. @@ -49,0 +50,5 @@ Amazon MQ requires using AWS Secrets Manager to store the password as a plaintex +Configuration key | Description +---|--- +`aws.arns.auth_http.ssl_options.cacertfile` | Certificate authority file for HTTP authentication SSL/TLS connections. Amazon MQ requires using Amazon S3 or to store the certificate. +`aws.arns.auth_http.ssl_options.certfile` | Certificate file for mutual TLS connections between Amazon MQ and the HTTP authentication server. Amazon MQ requires using Amazon S3 or to store the certificate. +`aws.arns.auth_http.ssl_options.keyfile` | Private key file for mutual TLS connections between Amazon MQ and the HTTP authentication server. Amazon MQ requires using AWS Secrets Manager to store the private key. @@ -51,16 +56,7 @@ Amazon MQ requires using AWS Secrets Manager to store the password as a plaintex -Amazon MQ requires using AWS Secrets Manager to store the password as a plaintext value - -`aws.arns.auth_ldap.ssl_options.cacertfile` - - -Certificate authority file for TLS connections between Amazon MQ and the LDAP server - -`aws.arns.auth_ldap.ssl_options.certfile` - - -Certificate file for mutual TLS connections between Amazon MQ and the LDAP server - -`aws.arns.auth_ldap.ssl_options.keyfile` - - -Private key file for mutual TLS connections between Amazon MQ and the LDAP server +Configuration key | Description +---|--- +`aws.arns.auth_ldap.ssl_options.cacertfile` | Certificate authority file for LDAP SSL/TLS connections. Amazon MQ requires using Amazon S3 or to store the certificate. +`aws.arns.auth_ldap.ssl_options.certfile` | Certificate file for mutual TLS connections between Amazon MQ and the LDAP server. Amazon MQ requires using Amazon S3 or to store the certificate. +`aws.arns.auth_ldap.ssl_options.keyfile` | Private key file for mutual TLS connections between Amazon MQ and the LDAP server. Amazon MQ requires using AWS Secrets Manager to store the private key. +`aws.arns.auth_ldap.dn_lookup_bind.password` | Password for LDAP DN lookup bind. Amazon MQ requires using AWS Secrets Manager to store the password as a plaintext value. +`aws.arns.auth_ldap.other_bind.password` | Password for LDAP other bind. Amazon MQ requires using AWS Secrets Manager to store the password as a plaintext value.