AWS mwaa: MWAA access policies: InvokeRestApi VPC condition guidance
Summary
Updates the InvokeRestApi bullet to state that private-webserver environments can invoke the action over the public internet (requiring airflow:InvokeRestApi and airflow:CreateWebLoginToken) and to recommend aws:SourceVpc/aws:SourceVpce conditions to confine calls to a VPC.
Security assessment
Same security-relevant clarification as the REST API page: it documents the required IAM permissions and the VPC/VPC-endpoint condition keys that scope InvokeRestApi, mitigating unauthorized network access. It is documentation of access-control hardening, not a fix for a named vulnerability.
Evidence
+ * To confine `InvokeRestApi` calls to a Virtual Private Cloud (VPC), use the `aws:SourceVpc` or `aws:SourceVpce` key to apply more granular access control for this operation. For more information about this condition key, see [aws:SourceVpc](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc)
Diff
diff --git a/mwaa/latest/userguide/access-policies.md b/mwaa/latest/userguide/access-policies.md index f6fd965a2..0f8c08f05 100644 --- a//mwaa/latest/userguide/access-policies.md +++ b//mwaa/latest/userguide/access-policies.md @@ -629 +629,3 @@ JSON - * While configuring a private webserver, the `InvokeRestApi` action cannot be invoked from outside of a Virtual Private Cloud (VPC). You can use the `aws:SourceVpc` key to apply more granular access control for this operation. For more information, refer to [aws:SourceVpc](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc) + * For environments with a private webserver, you can invoke the `InvokeRestApi` action over the public internet. This requires the `airflow:InvokeRestApi` and `airflow:CreateWebLoginToken` permissions in your IAM policy. + + * To confine `InvokeRestApi` calls to a Virtual Private Cloud (VPC), use the `aws:SourceVpc` or `aws:SourceVpce` key to apply more granular access control for this operation. For more information about this condition key, see [aws:SourceVpc](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc)