This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html).

# AWS::MWAAServerless::Workflow
<a name="aws-resource-mwaaserverless-workflow"></a>

Creates a new workflow in Amazon Managed Workflows for Apache Airflow Serverless. This operation initializes a workflow with the specified configuration including the workflow definition, execution role, and optional settings for encryption, logging, and networking. You must provide the workflow definition as a YAML file stored in Amazon S3 that defines the DAG structure using supported AWS operators. Amazon Managed Workflows for Apache Airflow Serverless automatically creates the first version of the workflow and sets up the necessary execution environment with multi-tenant isolation and security controls.

## Syntax
<a name="aws-resource-mwaaserverless-workflow-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-resource-mwaaserverless-workflow-syntax.json"></a>

```
{
  "Type" : "AWS::MWAAServerless::Workflow",
  "Properties" : {
      "[DefinitionS3Location](#cfn-mwaaserverless-workflow-definitions3location)" : S3Location,
      "[Description](#cfn-mwaaserverless-workflow-description)" : String,
      "[EncryptionConfiguration](#cfn-mwaaserverless-workflow-encryptionconfiguration)" : EncryptionConfiguration,
      "[LoggingConfiguration](#cfn-mwaaserverless-workflow-loggingconfiguration)" : LoggingConfiguration,
      "[Name](#cfn-mwaaserverless-workflow-name)" : String,
      "[NetworkConfiguration](#cfn-mwaaserverless-workflow-networkconfiguration)" : NetworkConfiguration,
      "[RoleArn](#cfn-mwaaserverless-workflow-rolearn)" : String,
      "[Tags](#cfn-mwaaserverless-workflow-tags)" : {Key: Value, ...},
      "[TriggerMode](#cfn-mwaaserverless-workflow-triggermode)" : String
    }
}
```

### YAML
<a name="aws-resource-mwaaserverless-workflow-syntax.yaml"></a>

```
Type: AWS::MWAAServerless::Workflow
Properties:
  [DefinitionS3Location](#cfn-mwaaserverless-workflow-definitions3location): 
    S3Location
  [Description](#cfn-mwaaserverless-workflow-description): String
  [EncryptionConfiguration](#cfn-mwaaserverless-workflow-encryptionconfiguration): 
    EncryptionConfiguration
  [LoggingConfiguration](#cfn-mwaaserverless-workflow-loggingconfiguration): 
    LoggingConfiguration
  [Name](#cfn-mwaaserverless-workflow-name): String
  [NetworkConfiguration](#cfn-mwaaserverless-workflow-networkconfiguration): 
    NetworkConfiguration
  [RoleArn](#cfn-mwaaserverless-workflow-rolearn): String
  [Tags](#cfn-mwaaserverless-workflow-tags): 
    Key: Value
  [TriggerMode](#cfn-mwaaserverless-workflow-triggermode): String
```

## Properties
<a name="aws-resource-mwaaserverless-workflow-properties"></a>

`DefinitionS3Location`  <a name="cfn-mwaaserverless-workflow-definitions3location"></a>
The Amazon S3 location of the workflow definition file for this version.  
*Required*: Yes  
*Type*: [S3Location](aws-properties-mwaaserverless-workflow-s3location.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Description`  <a name="cfn-mwaaserverless-workflow-description"></a>
The description of the workflow.  
*Required*: No  
*Type*: String  
*Pattern*: `^.+$`  
*Minimum*: `1`  
*Maximum*: `1024`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`EncryptionConfiguration`  <a name="cfn-mwaaserverless-workflow-encryptionconfiguration"></a>
The configuration for encrypting workflow data at rest and in transit. Specifies the encryption type and optional KMS key for customer-managed encryption.  
*Required*: No  
*Type*: [EncryptionConfiguration](aws-properties-mwaaserverless-workflow-encryptionconfiguration.md)  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`LoggingConfiguration`  <a name="cfn-mwaaserverless-workflow-loggingconfiguration"></a>
The configuration for workflow logging. Specifies the CloudWatch log group where workflow execution logs are stored. Amazon Managed Workflows for Apache Airflow Serverless automatically exports worker logs and task-level information to the specified log group in your account using remote logging functionality. This provides comprehensive observability for debugging and monitoring workflow execution across the distributed, serverless environment.  
*Required*: No  
*Type*: [LoggingConfiguration](aws-properties-mwaaserverless-workflow-loggingconfiguration.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Name`  <a name="cfn-mwaaserverless-workflow-name"></a>
The name of the workflow.  
*Required*: No  
*Type*: String  
*Pattern*: `^[a-zA-Z0-9]+[a-zA-Z0-9\.\-_]*$`  
*Minimum*: `1`  
*Maximum*: `255`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`NetworkConfiguration`  <a name="cfn-mwaaserverless-workflow-networkconfiguration"></a>
Network configuration for the workflow execution environment, including VPC security groups and subnets for secure network access. When specified, Amazon Managed Workflows for Apache Airflow Serverless deploys ECS worker tasks in your customer VPC to provide secure connectivity to your resources. If not specified, tasks run in the service's default worker VPC with network isolation from other customers. This configuration enables secure access to VPC-only resources like RDS databases or private endpoints.  
*Required*: No  
*Type*: [NetworkConfiguration](aws-properties-mwaaserverless-workflow-networkconfiguration.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RoleArn`  <a name="cfn-mwaaserverless-workflow-rolearn"></a>
The Amazon Resource Name (ARN) of the IAM role that Amazon Managed Workflows for Apache Airflow Serverless assumes when executing the workflow. This role must have the necessary permissions to access the required AWS services and resources that your workflow tasks will interact with. The role is used for task execution in the isolated, multi-tenant environment and should follow the principle of least privilege. Amazon Managed Workflows for Apache Airflow Serverless validates role access during workflow creation but runtime permission checks are performed by the target services.  
*Required*: Yes  
*Type*: String  
*Pattern*: `^arn:aws(?:-(?:cn|us-gov|iso|iso-b|iso-e|iso-f))?:iam::[0-9]{12}:role(/[a-zA-Z0-9+=,.@_-]{1,512})*?/[a-zA-Z0-9+=,.@_-]{1,64}$`  
*Minimum*: `1`  
*Maximum*: `2048`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Tags`  <a name="cfn-mwaaserverless-workflow-tags"></a>
A map of tags to assign to the workflow resource. Tags are key-value pairs that are used for resource organization and cost allocation.  
*Required*: No  
*Type*: Object of String  
*Pattern*: `^[\w\d+\-\.\:/@]{1,128}$`  
*Minimum*: `0`  
*Maximum*: `256`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`TriggerMode`  <a name="cfn-mwaaserverless-workflow-triggermode"></a>
The trigger mode for the workflow execution.  
*Required*: No  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `255`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## Return values
<a name="aws-resource-mwaaserverless-workflow-return-values"></a>

### Ref
<a name="aws-resource-mwaaserverless-workflow-return-values-ref"></a>

When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the workflow ARN.

For more information about using the `Ref` function, see [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html).

### Fn::GetAtt
<a name="aws-resource-mwaaserverless-workflow-return-values-fn--getatt"></a>

The `Fn::GetAtt` intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the `Fn::GetAtt` intrinsic function, see [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html).

#### 
<a name="aws-resource-mwaaserverless-workflow-return-values-fn--getatt-fn--getatt"></a>

`CreatedAt`  <a name="CreatedAt-fn::getatt"></a>
The timestamp when the workflow was created, in ISO 8601 date-time format.

`ModifiedAt`  <a name="ModifiedAt-fn::getatt"></a>
The timestamp when the workflow was last modified, in ISO 8601 date-time format.

`WorkflowArn`  <a name="WorkflowArn-fn::getatt"></a>
The Amazon Resource Name (ARN) of the workflow.

`WorkflowStatus`  <a name="WorkflowStatus-fn::getatt"></a>
The current status of the workflow.

`WorkflowVersion`  <a name="WorkflowVersion-fn::getatt"></a>
The version identifier of the workflow.

# AWS::MWAAServerless::Workflow EncryptionConfiguration
<a name="aws-properties-mwaaserverless-workflow-encryptionconfiguration"></a>

Configuration for encrypting workflow data at rest and in transit. Amazon Managed Workflows for Apache Airflow Serverless provides comprehensive encryption capabilities to protect sensitive workflow data, parameters, and execution logs. When using customer-managed keys, the service integrates with AWSAWS KMS to provide fine-grained access control and audit capabilities. Encryption is applied consistently across the distributed execution environment including task containers, metadata storage, and log streams.

## Syntax
<a name="aws-properties-mwaaserverless-workflow-encryptionconfiguration-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-mwaaserverless-workflow-encryptionconfiguration-syntax.json"></a>

```
{
  "[KmsKeyId](#cfn-mwaaserverless-workflow-encryptionconfiguration-kmskeyid)" : String,
  "[Type](#cfn-mwaaserverless-workflow-encryptionconfiguration-type)" : String
}
```

### YAML
<a name="aws-properties-mwaaserverless-workflow-encryptionconfiguration-syntax.yaml"></a>

```
  [KmsKeyId](#cfn-mwaaserverless-workflow-encryptionconfiguration-kmskeyid): String
  [Type](#cfn-mwaaserverless-workflow-encryptionconfiguration-type): String
```

## Properties
<a name="aws-properties-mwaaserverless-workflow-encryptionconfiguration-properties"></a>

`KmsKeyId`  <a name="cfn-mwaaserverless-workflow-encryptionconfiguration-kmskeyid"></a>
The ID or ARN of the AWS KMS key to use for encryption. Required when `Type` is `CUSTOMER_MANAGED_KEY`.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`Type`  <a name="cfn-mwaaserverless-workflow-encryptionconfiguration-type"></a>
The type of encryption to use. Values are `AWS_MANAGED_KEY` (AWS manages the encryption key) or `CUSTOMER_MANAGED_KEY` (you provide a KMS key).  
*Required*: Yes  
*Type*: String  
*Allowed values*: `AWS_MANAGED_KEY | CUSTOMER_MANAGED_KEY`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

# AWS::MWAAServerless::Workflow LoggingConfiguration
<a name="aws-properties-mwaaserverless-workflow-loggingconfiguration"></a>

Configuration for workflow logging that specifies where you should store your workflow execution logs. Amazon Managed Workflows for Apache Airflow Serverless provides comprehensive logging capabilities that capture workflow execution details, task-level information, and system events. Logs are automatically exported to your specified CloudWatch log group using remote logging functionality, providing centralized observability across the distributed, multi-tenant execution environment. This enables effective debugging, monitoring, and compliance auditing of workflow executions.

## Syntax
<a name="aws-properties-mwaaserverless-workflow-loggingconfiguration-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-mwaaserverless-workflow-loggingconfiguration-syntax.json"></a>

```
{
  "[LogGroupName](#cfn-mwaaserverless-workflow-loggingconfiguration-loggroupname)" : String
}
```

### YAML
<a name="aws-properties-mwaaserverless-workflow-loggingconfiguration-syntax.yaml"></a>

```
  [LogGroupName](#cfn-mwaaserverless-workflow-loggingconfiguration-loggroupname): String
```

## Properties
<a name="aws-properties-mwaaserverless-workflow-loggingconfiguration-properties"></a>

`LogGroupName`  <a name="cfn-mwaaserverless-workflow-loggingconfiguration-loggroupname"></a>
The name of the CloudWatch log group where workflow execution logs are stored.  
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::MWAAServerless::Workflow NetworkConfiguration
<a name="aws-properties-mwaaserverless-workflow-networkconfiguration"></a>

Network configuration for workflow execution. Specifies VPC security groups and subnets for secure network access. When provided, Amazon Managed Workflows for Apache Airflow Serverless deploys ECS worker tasks in your specified VPC configuration, enabling secure access to VPC-only resources. The service uses a proxy API container architecture where one container handles external communication while the worker container connects to your VPC for task execution. This design provides both security isolation and connectivity flexibility.

## Syntax
<a name="aws-properties-mwaaserverless-workflow-networkconfiguration-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-mwaaserverless-workflow-networkconfiguration-syntax.json"></a>

```
{
  "[SecurityGroupIds](#cfn-mwaaserverless-workflow-networkconfiguration-securitygroupids)" : [ String, ... ],
  "[SubnetIds](#cfn-mwaaserverless-workflow-networkconfiguration-subnetids)" : [ String, ... ]
}
```

### YAML
<a name="aws-properties-mwaaserverless-workflow-networkconfiguration-syntax.yaml"></a>

```
  [SecurityGroupIds](#cfn-mwaaserverless-workflow-networkconfiguration-securitygroupids): 
    - String
  [SubnetIds](#cfn-mwaaserverless-workflow-networkconfiguration-subnetids): 
    - String
```

## Properties
<a name="aws-properties-mwaaserverless-workflow-networkconfiguration-properties"></a>

`SecurityGroupIds`  <a name="cfn-mwaaserverless-workflow-networkconfiguration-securitygroupids"></a>
A list of VPC security group IDs to associate with the workflow execution environment.  
*Required*: No  
*Type*: Array of String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubnetIds`  <a name="cfn-mwaaserverless-workflow-networkconfiguration-subnetids"></a>
A list of VPC subnet IDs where the workflow execution environment is deployed.  
*Required*: No  
*Type*: Array of String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::MWAAServerless::Workflow S3Location
<a name="aws-properties-mwaaserverless-workflow-s3location"></a>

Specifies the Amazon S3 location of a workflow definition file. This structure contains the bucket name, object key, and optional version ID for the workflow definition. Amazon Managed Workflows for Apache Airflow Serverless takes a snapshot of the definition file at the time of workflow creation or update, ensuring that the workflow behavior remains consistent even if the source file is modified. The definition must be a valid YAML file that uses supported AWS operators and Amazon Managed Workflows for Apache Airflow Serverless syntax.

## Syntax
<a name="aws-properties-mwaaserverless-workflow-s3location-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-mwaaserverless-workflow-s3location-syntax.json"></a>

```
{
  "[Bucket](#cfn-mwaaserverless-workflow-s3location-bucket)" : String,
  "[ObjectKey](#cfn-mwaaserverless-workflow-s3location-objectkey)" : String,
  "[VersionId](#cfn-mwaaserverless-workflow-s3location-versionid)" : String
}
```

### YAML
<a name="aws-properties-mwaaserverless-workflow-s3location-syntax.yaml"></a>

```
  [Bucket](#cfn-mwaaserverless-workflow-s3location-bucket): String
  [ObjectKey](#cfn-mwaaserverless-workflow-s3location-objectkey): String
  [VersionId](#cfn-mwaaserverless-workflow-s3location-versionid): String
```

## Properties
<a name="aws-properties-mwaaserverless-workflow-s3location-properties"></a>

`Bucket`  <a name="cfn-mwaaserverless-workflow-s3location-bucket"></a>
The name of the Amazon S3 bucket that contains the workflow definition file.  
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ObjectKey`  <a name="cfn-mwaaserverless-workflow-s3location-objectkey"></a>
The key (name) of the workflow definition file within the S3 bucket.  
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`VersionId`  <a name="cfn-mwaaserverless-workflow-s3location-versionid"></a>
Optional. The version ID of the workflow definition file in Amazon S3. If not specified, the latest version is used.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::MWAAServerless::Workflow ScheduleConfiguration
<a name="aws-properties-mwaaserverless-workflow-scheduleconfiguration"></a>

The configuration to use to schedule automated workflow execution using cron expressions. Amazon Managed Workflows for Apache Airflow Serverless integrates with EventBridge Scheduler to provide cost-effective, timezone-aware scheduling capabilities. The service supports both time-based and event-based scheduling (event-based scheduling available post-GA). When a workflow definition includes scheduling information, Amazon Managed Workflows for Apache Airflow Serverless automatically configures the appropriate triggers and ensures only one version of a workflow has an active schedule at any time.

## Syntax
<a name="aws-properties-mwaaserverless-workflow-scheduleconfiguration-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-mwaaserverless-workflow-scheduleconfiguration-syntax.json"></a>

```
{
  "[CronExpression](#cfn-mwaaserverless-workflow-scheduleconfiguration-cronexpression)" : String
}
```

### YAML
<a name="aws-properties-mwaaserverless-workflow-scheduleconfiguration-syntax.yaml"></a>

```
  [CronExpression](#cfn-mwaaserverless-workflow-scheduleconfiguration-cronexpression): String
```

## Properties
<a name="aws-properties-mwaaserverless-workflow-scheduleconfiguration-properties"></a>

`CronExpression`  <a name="cfn-mwaaserverless-workflow-scheduleconfiguration-cronexpression"></a>
A cron expression that defines when the workflow is automatically executed. Uses standard cron syntax.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)