Amazon MWAA now supports fine-grained access control with IAM Identity Center and multi-team environments

Amazon MWAA Fine-Grained Access Control

Amazon Managed Workflows for Apache Airflow (Amazon MWAA) now supports fine-grained access control, allowing administrators to control access to workflows and resources with precision. This is achieved through two new capabilities: IAM Identity Center integration and multi-team environments.

IAM Identity Center Integration

Users can now sign in to the Apache Airflow UI using their corporate identity provider. Authorization is evaluated per request using IAM policies attached to IAM Identity Center Permission Sets, with condition keys that scope access by resource type, action, and specific resource ID.

Multi-Team Environments

Several teams can now share a single MWAA environment. Each team has its own DAG folder in Amazon S3, and users see only shared DAGs plus their own teams' DAGs based on IAM Identity Center group membership. Teams benefit from reduced costs through shared infrastructure and simplified management by configuring environment settings once. Multi-team environments are based on the Apache Airflow multi-team feature, which is currently in preview.

What to do

• Review the IAM Identity Center integration documentation for more details.
• Explore the multi-team environments documentation to understand how to set up and manage multi-team environments.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.