AWS mwaa documentation change
Summary
Added guidance for VPCs without internet access using new 'Both public and private' access mode
Security assessment
This update provides security best practices for network isolation scenarios using the new access mode. It enhances security documentation but doesn't address a specific vulnerability.
Diff
diff --git a/mwaa/latest/userguide/networking-about.md b/mwaa/latest/userguide/networking-about.md index 50a6c3375..ecae15171 100644 --- a//mwaa/latest/userguide/networking-about.md +++ b//mwaa/latest/userguide/networking-about.md @@ -11 +11 @@ TermsWhat's supportedVPC infrastructure overviewExample use cases for an Amazon -A Amazon VPC is a virtual network linked to your AWS account. It gives you cloud security and the ability to scale dynamically by providing fine-grained control over your virtual infrastructure and network traffic segmentation. This page describes the Amazon VPC infrastructure with _public routing_ or _private routing_ needed to support an Amazon Managed Workflows for Apache Airflow environment. +A Amazon VPC is a virtual network linked to your AWS account. It gives you cloud security and the ability to scale dynamically by providing fine-grained control over your virtual infrastructure and network traffic segmentation. This page describes the Amazon VPC infrastructure with _public routing_ , _private routing_ , or _both public and private routing_ needed to support an Amazon Managed Workflows for Apache Airflow environment. @@ -219 +219,12 @@ If internet access in your VPC is allowed by your organization, _and_ you would -If internet access in your VPC is **not allowed** by your organization: +If internet access in your VPC is **not allowed** by your organization, _and_ you want the Apache Airflow web server to remain accessible over the internet: + + 1. Create an Amazon VPC network without internet access. + + 2. Create an environment with the **Both public and private network access** mode for your Apache Airflow webserver. This option is available for Apache Airflow version 3.2.1 and later. + + 3. **What we recommend** : We recommend using the CloudFormation template to create an Amazon VPC without internet access and the VPC endpoints for each AWS service used by Amazon MWAA in [Option three: Creating an Amazon VPC network without internet access](./vpc-create.html#vpc-create-template-private-only). + + + + +If internet access in your VPC is **not allowed** by your organization, _and_ you want to limit Apache Airflow webserver access to users within your VPC: