AWS mwaa: Add IAM condition keys to MWAA Serverless role policies

Service: mwaa · 2026-10-07 · Documentation medium

File: mwaa/latest/mwaa-serverless-userguide/prerequisites-set-up.md · Type: iam

Summary

Adds StringEquals conditions on iam:AWSServiceName and iam:PassedToService restricting role creation/assumption and PassRole to airflow-serverless.amazonaws.com, and normalizes a permission string's quoting.

Security assessment

The added Condition blocks restrict the trust/PassRole policies so the role can only be assumed or passed to the MWAA Serverless service principal, a hardening measure against confused-deputy/privilege-escalation via iam:PassRole. It is a preventive configuration hardening example rather than a fix for a disclosed vulnerability.

Evidence

+              "iam:AWSServiceName": "airflow-serverless.amazonaws.com"

Diff

diff --git a/mwaa/latest/mwaa-serverless-userguide/prerequisites-set-up.md b/mwaa/latest/mwaa-serverless-userguide/prerequisites-set-up.md
index dd11f95..c6b7f6b 100644
--- a//mwaa/latest/mwaa-serverless-userguide/prerequisites-set-up.md
+++ b//mwaa/latest/mwaa-serverless-userguide/prerequisites-set-up.md
@@ -57 +57,6 @@ JSON
-          ]
+          ],
+          "Condition": {
+            "StringEquals": {
+              "iam:AWSServiceName": "airflow-serverless.amazonaws.com"
+            }
+          }
@@ -67 +72,6 @@ JSON
-          ]
+          ],
+          "Condition": {
+            "StringEquals": {
+              "iam:PassedToService": "airflow-serverless.amazonaws.com"
+            }
+          }
@@ -74 +84 @@ JSON
-            's3:GetObjectVersion'
+            "s3:GetObjectVersion"