AWS mwaa: MWAA REST API exposure clarified; VPC condition keys
Summary
Rewrites the InvokeRestApi access note: it is an AWS SigV4/IAM-authenticated service API that retrieves webserver data over internal networking, the public call path for private-webserver environments requires airflow:InvokeRestApi and airflow:CreateWebLoginToken, and calls can be confined to a VPC using aws:SourceVpc/aws:SourceVpce condition keys.
Security assessment
Documents the network exposure of the InvokeRestApi operation, the IAM permissions it requires, and how to restrict invocation by source VPC/VPC endpoint—directly relevant to preventing unauthorized or out-of-network API access. No specific vulnerability or incident is referenced.
Evidence
+To confine `InvokeRestApi` calls to a VPC, apply an IAM policy condition using the `aws:SourceVpc` or `aws:SourceVpce` key. For more information about this condition key, see [aws:SourceVpc](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc).
Diff
diff --git a/mwaa/latest/userguide/access-mwaa-apache-airflow-rest-api.md b/mwaa/latest/userguide/access-mwaa-apache-airflow-rest-api.md index 1b5d327c1..ec6f1d302 100644 --- a//mwaa/latest/userguide/access-mwaa-apache-airflow-rest-api.md +++ b//mwaa/latest/userguide/access-mwaa-apache-airflow-rest-api.md @@ -96 +96,5 @@ To access the Apache Airflow REST API using AWS credentials, you must grant the -While configuring a private webserver, the `InvokeRestApi` action cannot be invoked from outside of a Virtual Private Cloud (VPC). You can use the `aws:SourceVpc` key to apply more granular access control for this operation. For more information, refer to [aws:SourceVpc](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc). +`InvokeRestApi` is an Amazon MWAA service API call authenticated with AWS credentials (SigV4/IAM). When you call it, Amazon MWAA retrieves data from the Apache Airflow webserver over AWS internal networking. The webserver itself is never exposed to the public internet. + +For environments with a private webserver, you can call `InvokeRestApi` over the public internet. This requires the `airflow:InvokeRestApi` and `airflow:CreateWebLoginToken` permissions in your IAM policy. Interactive access to the Apache Airflow web UI is restricted to the Virtual Private Cloud (VPC). + +To confine `InvokeRestApi` calls to a VPC, apply an IAM policy condition using the `aws:SourceVpc` or `aws:SourceVpce` key. For more information about this condition key, see [aws:SourceVpc](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc).