The microscopic mechanisms underpinning the spontaneous surface passivation of metals from ubiquitous water have remained largely elusive. Here, using in situ environmental electron microscopy to atomically monitor the reaction dynamics between aluminum surfaces and water vapor, we provide direct experimental evidence that the surface passivation results in a bilayer oxide film consisting of a crystalline-like Al(OH)3 top layer and an inner layer of amorphous Al2O3. The Al(OH)3 layer maintains a constant thickness of ~5.0 Å, while the inner Al2O3 layer grows at the Al2O3/Al interface to a limiting thickness. On the basis of experimental data and atomistic modeling, we show the tunability of the dissociation pathways of H2O molecules with the Al, Al2O3, and Al(OH)3 surface terminations. The fundamental insights may have practical significance for the design of materials and reactions for two seemingly disparate but fundamentally related disciplines of surface passivation and catalytic H2 production from water.