AWS amazon-mq medium security documentation change
Summary
Added important note about OAuth2 authentication requiring network connectivity to JWKS endpoint in private brokers
Security assessment
This change addresses potential authentication failures in private brokers by explicitly warning that OAuth2 JWKS endpoints must be reachable within the VPC. Without this connectivity, authentication fails, creating a denial-of-service vulnerability. The note provides mitigation strategies (VPC endpoints/NAT gateways) to prevent misconfigurations.
Diff
diff --git a/amazon-mq/latest/developer-guide/configuring-private-broker.md b/amazon-mq/latest/developer-guide/configuring-private-broker.md index 22b50e6f5..0fbdb61b5 100644 --- a//amazon-mq/latest/developer-guide/configuring-private-broker.md +++ b//amazon-mq/latest/developer-guide/configuring-private-broker.md @@ -45,0 +46,4 @@ Public RabbitMQ brokers do not use subnets or security groups. +###### Important + +If you configure OAuth2 authentication for a private broker, the OAuth2 JWKS endpoint must be reachable from within the broker's VPC. Because private brokers do not have public internet access, the JWKS endpoint provided by your identity provider (for example, Amazon Cognito or an external identity provider) must be accessible through your VPC. You can enable this connectivity using a VPC endpoint, a NAT gateway, or other networking configurations. Without proper network connectivity to the JWKS endpoint, the broker cannot validate OAuth2 access tokens and authentication will fail. +