AWS amazon-mq documentation change
Summary
Added IAM authentication and authorization section describing AWS IAM credential integration with JWT tokens for RabbitMQ
Security assessment
Introduces documentation for new IAM-based authentication method but does not address a specific security vulnerability
Diff
diff --git a/amazon-mq/latest/developer-guide/rabbitmq-authentication.md b/amazon-mq/latest/developer-guide/rabbitmq-authentication.md index 90a9b185e..6673cdc9e 100644 --- a//amazon-mq/latest/developer-guide/rabbitmq-authentication.md +++ b//amazon-mq/latest/developer-guide/rabbitmq-authentication.md @@ -5 +5 @@ -Simple authentication and authorizationOAuth 2.0 authentication and authorizationLDAP authentication and authorizationHTTP authentication and authorizationSSL certificate authentication +Simple authentication and authorizationOAuth 2.0 authentication and authorizationIAM authentication and authorizationLDAP authentication and authorizationHTTP authentication and authorizationSSL certificate authentication @@ -18,0 +19,4 @@ In this method, broker users and their permissions are managed by an external OA +## IAM authentication and authorization + +In this method, broker users authenticate using AWS IAM credentials through [IAM outbound federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html). IAM credentials are used to obtain JWT tokens from AWS Security Token Service (STS), and these JWT tokens serve as OAuth 2.0 tokens for authentication. This method leverages the existing OAuth 2.0 support in Amazon MQ for RabbitMQ, where AWS acts as the OAuth 2.0 identity provider. User authentication is handled by AWS IAM, while resource permissions for vhosts, exchanges, queues, and topics are managed through IAM policies and scope aliases configured in RabbitMQ. For more information, see [IAM authentication and authorization](./iam-for-amq-for-rabbitmq.html). +