AWS mwaa: Warn against storing secrets in workflow environment variables
Summary
Rewords the Secrets Manager best practice and adds a new bullet warning that secrets must not be placed in workflow environment variables because GetWorkflow returns them in plain text, with links to the connections and environment-variables docs.
Security assessment
The added line explicitly documents a concrete weakness: secrets placed in workflow environment variables are returned in plain text by the GetWorkflow API, enabling credential disclosure to anyone who can read workflow definitions. This is security best-practice guidance mitigating a data-exposure risk rather than a patch for a named CVE.
Evidence
+ * Don't store secrets in workflow environment variables, because `GetWorkflow` returns them in plain text. For more information, see [Using environment variables in Amazon MWAA Serverless workflows](./workflows-environment-variables.html).
Diff
diff --git a/mwaa/latest/mwaa-serverless-userguide/security-best-practices.md b/mwaa/latest/mwaa-serverless-userguide/security-best-practices.md index 4c43dfd..5e24f6a 100644 --- a//mwaa/latest/mwaa-serverless-userguide/security-best-practices.md +++ b//mwaa/latest/mwaa-serverless-userguide/security-best-practices.md @@ -24 +24,3 @@ To implement security boundaries for your workflows: - * Store secrets in AWS Secrets Manager. While this will not prevent users who can write workflow definitions from reading secrets, it prevents them from modifying the secrets that your workflow uses. + * Store secrets in AWS Secrets Manager. Although this doesn't prevent users who can write workflow definitions from reading secrets, it prevents them from modifying the secrets that your workflow uses. For more information about configuring a secrets backend, see [Managing connections and variables](./connections.html). + + * Don't store secrets in workflow environment variables, because `GetWorkflow` returns them in plain text. For more information, see [Using environment variables in Amazon MWAA Serverless workflows](./workflows-environment-variables.html).