AWS mwaa: Add airflow:PublishMetrics and correct ARNs in MWAA execution role policy

Service: mwaa · 2026-10-21 · Documentation medium

File: mwaa/latest/userguide/mwaa-create-role.md · Type: iam

Summary

Adds an Allow statement for airflow:PublishMetrics scoped to the environment ARN, fixes the CloudWatch Logs log-group ARN to use the 'airflow-your-environment-name-*' pattern, and removes stray curly braces from the environment resource ARN placeholder.

Security assessment

The diff modifies the documented IAM execution-role policy: it grants a new scoped action (airflow:PublishMetrics) and corrects resource ARNs so permissions match actual resource names rather than malformed placeholders, which affects least-privilege scoping of the MWAA role.

Evidence

+       "Action": "airflow:PublishMetrics",

Diff

diff --git a/mwaa/latest/userguide/mwaa-create-role.md b/mwaa/latest/userguide/mwaa-create-role.md
index 0707e4b..35f9f86 100644
--- a//mwaa/latest/userguide/mwaa-create-role.md
+++ b//mwaa/latest/userguide/mwaa-create-role.md
@@ -250,0 +251,5 @@ JSON
+      {
+       "Effect": "Allow",
+       "Action": "airflow:PublishMetrics",
+       "Resource": "arn:aws:airflow:us-east-1:111122223333:environment/your-environment-name"
+      },
@@ -284 +289 @@ JSON
-        "arn:aws:logs:us-east-1:111122223333:log-group:airflow-your-environment-name:*"
+        "arn:aws:logs:us-east-1:111122223333:log-group:airflow-your-environment-name-*"
@@ -408 +413 @@ JSON
-                "Resource": "arn:aws:airflow:us-east-1:111122223333:environment/{your-environment-name}"
+                "Resource": "arn:aws:airflow:us-east-1:111122223333:environment/your-environment-name"
@@ -443 +448 @@ JSON
-                "arn:aws:logs:us-east-1:111122223333:log-group:airflow-{your-environment-name}-*"
+                "arn:aws:logs:us-east-1:111122223333:log-group:airflow-your-environment-name-*"