You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "vincbeck (via GitHub)" <gi...@apache.org> on 2024/04/11 13:38:03 UTC
[PR] AWS auth manager documentation: manage environment section [airflow]
vincbeck opened a new pull request, #38932:
URL: https://github.com/apache/airflow/pull/38932
Complete documentation for AWS auth manager. Add a section to explain how to manager users and permissions using AWS auth manager.
See below the generated documentation.
[Manage Airflow environment with AWS auth manager — apache-airflow-providers-amazon Documentation.pdf](https://github.com/apache/airflow/files/14946793/Manage.Airflow.environment.with.AWS.auth.manager.apache-airflow-providers-amazon.Documentation.pdf)
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
<!-- Please keep an empty line above the dashes. -->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [newsfragments](https://github.com/apache/airflow/tree/main/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AWS auth manager documentation: manage environment section [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #38932:
URL: https://github.com/apache/airflow/pull/38932#discussion_r1566270520
##########
docs/apache-airflow-providers-amazon/auth-manager/manage/index.rst:
##########
@@ -18,3 +18,205 @@
================================================
Manage Airflow environment with AWS auth manager
================================================
+
+When the AWS auth manager is used, all users and their permissions are no longer managed by
+Airflow itself but by AWS through two different services: AWS IAM Identity Center (users) and Amazon Verified
+Permissions (permissions).
+
+Manage users through AWS IAM Identity Center
+============================================
+
+Users
+-----
+
+All users having access to the Airflow environment must be defined in AWS IAM Identity Center.
+You can use AWS IAM Identity center as identity source or as a proxy between the identity source
+(e.g. Active Directory) and the Airflow environment.
+`See documentation for more details on how to manage your identity source <https://docs.aws.amazon.com/singlesignon/latest/userguide/identities.html>`__.
+
+You can see the list of users defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Users**.
+
+Groups
+------
+
+You can use groups in AWS IAM Identity center to group users in logical entities (e.g. by team, by department, ...).
+Later, these groups can be used in Amazon Verified Permissions to assign permissions to a group of users.
+`See documentation to add users to groups <https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html>`__.
+
+You can see the list of groups defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Groups**.
+
+Assign users and groups to the Airflow environment
+--------------------------------------------------
+
+.. note::
+ All users and groups defined in AWS IAM Identity Center do not have automatically access to the Airflow environment.
+ You need to manually assign which user can access to Airflow.
+
+To assign users and groups to Airflow, please follow the steps below.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+
+.. note::
+ If you manage users in AWS Managed Microsoft AD, make sure that the IAM Identity Center console is using the AWS
+ Region where your AWS Managed Microsoft AD directory is located before taking the next step.
+
+2. Choose **Applications**.
+3. Choose the **Customer managed** tab.
+4. In the list of applications, choose the application name ``Airflow``.
+5. On the application details page, in the **Assigned users and groups** section, choose **Assign users and groups**.
+6. In the **Assign users or groups** page, select the different users and groups you want to assign to Airflow.
+ You can also search users and groups.
+ You can specify multiple users or groups by selecting the applicable accounts as they appear in search results.
+7. Choose **Assign users**.
+
+Manage user permissions through Amazon Verified Permissions
+===========================================================
+
+AWS auth manager uses Amazon Verified Permissions to define and verify user permissions.
+It uses `Cedar language <https://www.cedarpolicy.com/>`__ to define fine-grained permissions for users.
+AWS auth manager uses one policy store to store all policies related to the Airflow environment.
+To manage these policies, please follow the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Policies**.
+4. On the **Policies** page, you can see the list of policies. To create a new policy, please follow steps below.
+
+ a. Choose **Create policy**.
+ b. Under **Create policy**, choose **Create static policy**.
+
+Policy format
+-------------
+
+Policies are defined using Cedar language in Amazon Verified Permissions.
+For a complete documentation, `see cedar language website <https://www.cedarpolicy.com/>`__.
+In cedar language, a policy is composed of three elements:
+
+* **Principal**. Who is making the request?
+* **Action**. What operation does the principal want to perform?
+* **Resource**. What does the principal want to perform the action on?
+
+Each of these three elements can have limited values in the context of the Airflow environment.
+You can see the list of principals, actions and resources in the policy store schema by following the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Schema**.
+
+Example of policies
+-------------------
+
+Here are some example of policies you can define in Amazon Verified Permissions.
+You can use them as-is if they fit exactly your use case.
+You can also modify and/or combine them to create your owned tailor made policies.
+
+Give all permissions to specific user
Review Comment:
#39040
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AWS auth manager documentation: manage environment section [airflow]
Posted by "Taragolis (via GitHub)" <gi...@apache.org>.
Taragolis merged PR #38932:
URL: https://github.com/apache/airflow/pull/38932
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AWS auth manager documentation: manage environment section [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #38932:
URL: https://github.com/apache/airflow/pull/38932#discussion_r1565915396
##########
docs/apache-airflow-providers-amazon/auth-manager/manage/index.rst:
##########
@@ -18,3 +18,205 @@
================================================
Manage Airflow environment with AWS auth manager
================================================
+
+When the AWS auth manager is used, all users and their permissions are no longer managed by
+Airflow itself but by AWS through two different services: AWS IAM Identity Center (users) and Amazon Verified
+Permissions (permissions).
+
+Manage users through AWS IAM Identity Center
+============================================
+
+Users
+-----
+
+All users having access to the Airflow environment must be defined in AWS IAM Identity Center.
+You can use AWS IAM Identity center as identity source or as a proxy between the identity source
+(e.g. Active Directory) and the Airflow environment.
+`See documentation for more details on how to manage your identity source <https://docs.aws.amazon.com/singlesignon/latest/userguide/identities.html>`__.
+
+You can see the list of users defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Users**.
+
+Groups
+------
+
+You can use groups in AWS IAM Identity center to group users in logical entities (e.g. by team, by department, ...).
+Later, these groups can be used in Amazon Verified Permissions to assign permissions to a group of users.
+`See documentation to add users to groups <https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html>`__.
+
+You can see the list of groups defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Groups**.
+
+Assign users and groups to the Airflow environment
+--------------------------------------------------
+
+.. note::
+ All users and groups defined in AWS IAM Identity Center do not have automatically access to the Airflow environment.
+ You need to manually assign which user can access to Airflow.
+
+To assign users and groups to Airflow, please follow the steps below.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+
+.. note::
+ If you manage users in AWS Managed Microsoft AD, make sure that the IAM Identity Center console is using the AWS
+ Region where your AWS Managed Microsoft AD directory is located before taking the next step.
+
+2. Choose **Applications**.
+3. Choose the **Customer managed** tab.
+4. In the list of applications, choose the application name ``Airflow``.
+5. On the application details page, in the **Assigned users and groups** section, choose **Assign users and groups**.
+6. In the **Assign users or groups** page, select the different users and groups you want to assign to Airflow.
+ You can also search users and groups.
+ You can specify multiple users or groups by selecting the applicable accounts as they appear in search results.
+7. Choose **Assign users**.
+
+Manage user permissions through Amazon Verified Permissions
+===========================================================
+
+AWS auth manager uses Amazon Verified Permissions to define and verify user permissions.
+It uses `Cedar language <https://www.cedarpolicy.com/>`__ to define fine-grained permissions for users.
+AWS auth manager uses one policy store to store all policies related to the Airflow environment.
+To manage these policies, please follow the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Policies**.
+4. On the **Policies** page, you can see the list of policies. To create a new policy, please follow steps below.
+
+ a. Choose **Create policy**.
+ b. Under **Create policy**, choose **Create static policy**.
+
+Policy format
+-------------
+
+Policies are defined using Cedar language in Amazon Verified Permissions.
+For a complete documentation, `see cedar language website <https://www.cedarpolicy.com/>`__.
+In cedar language, a policy is composed of three elements:
+
+* **Principal**. Who is making the request?
+* **Action**. What operation does the principal want to perform?
+* **Resource**. What does the principal want to perform the action on?
+
+Each of these three elements can have limited values in the context of the Airflow environment.
+You can see the list of principals, actions and resources in the policy store schema by following the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Schema**.
+
+Example of policies
+-------------------
+
+Here are some example of policies you can define in Amazon Verified Permissions.
+You can use them as-is if they fit exactly your use case.
+You can also modify and/or combine them to create your owned tailor made policies.
+
+Give all permissions to specific user
Review Comment:
Good point. I'll create a PR to cover these.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AWS auth manager documentation: manage environment section [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #38932:
URL: https://github.com/apache/airflow/pull/38932#issuecomment-2057045129
> I know the PR is already merged, so addressing my comments is optional here.
I address these comments in #39033
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] AWS auth manager documentation: manage environment section [airflow]
Posted by "shubham22 (via GitHub)" <gi...@apache.org>.
shubham22 commented on code in PR #38932:
URL: https://github.com/apache/airflow/pull/38932#discussion_r1565006331
##########
docs/apache-airflow-providers-amazon/auth-manager/manage/index.rst:
##########
@@ -18,3 +18,205 @@
================================================
Manage Airflow environment with AWS auth manager
================================================
+
+When the AWS auth manager is used, all users and their permissions are no longer managed by
+Airflow itself but by AWS through two different services: AWS IAM Identity Center (users) and Amazon Verified
+Permissions (permissions).
+
+Manage users through AWS IAM Identity Center
+============================================
+
+Users
+-----
+
+All users having access to the Airflow environment must be defined in AWS IAM Identity Center.
+You can use AWS IAM Identity center as identity source or as a proxy between the identity source
+(e.g. Active Directory) and the Airflow environment.
+`See documentation for more details on how to manage your identity source <https://docs.aws.amazon.com/singlesignon/latest/userguide/identities.html>`__.
+
+You can see the list of users defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Users**.
+
+Groups
+------
+
+You can use groups in AWS IAM Identity center to group users in logical entities (e.g. by team, by department, ...).
+Later, these groups can be used in Amazon Verified Permissions to assign permissions to a group of users.
+`See documentation to add users to groups <https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html>`__.
+
+You can see the list of groups defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Groups**.
+
+Assign users and groups to the Airflow environment
+--------------------------------------------------
+
+.. note::
+ All users and groups defined in AWS IAM Identity Center do not have automatically access to the Airflow environment.
Review Comment:
automatic access
##########
docs/apache-airflow-providers-amazon/auth-manager/manage/index.rst:
##########
@@ -18,3 +18,205 @@
================================================
Manage Airflow environment with AWS auth manager
================================================
+
+When the AWS auth manager is used, all users and their permissions are no longer managed by
+Airflow itself but by AWS through two different services: AWS IAM Identity Center (users) and Amazon Verified
+Permissions (permissions).
+
+Manage users through AWS IAM Identity Center
+============================================
+
+Users
+-----
+
+All users having access to the Airflow environment must be defined in AWS IAM Identity Center.
+You can use AWS IAM Identity center as identity source or as a proxy between the identity source
+(e.g. Active Directory) and the Airflow environment.
+`See documentation for more details on how to manage your identity source <https://docs.aws.amazon.com/singlesignon/latest/userguide/identities.html>`__.
+
+You can see the list of users defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Users**.
+
+Groups
+------
+
+You can use groups in AWS IAM Identity center to group users in logical entities (e.g. by team, by department, ...).
+Later, these groups can be used in Amazon Verified Permissions to assign permissions to a group of users.
+`See documentation to add users to groups <https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html>`__.
+
+You can see the list of groups defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Groups**.
+
+Assign users and groups to the Airflow environment
+--------------------------------------------------
+
+.. note::
+ All users and groups defined in AWS IAM Identity Center do not have automatically access to the Airflow environment.
+ You need to manually assign which user can access to Airflow.
+
+To assign users and groups to Airflow, please follow the steps below.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+
+.. note::
+ If you manage users in AWS Managed Microsoft AD, make sure that the IAM Identity Center console is using the AWS
+ Region where your AWS Managed Microsoft AD directory is located before taking the next step.
+
+2. Choose **Applications**.
+3. Choose the **Customer managed** tab.
+4. In the list of applications, choose the application name ``Airflow``.
+5. On the application details page, in the **Assigned users and groups** section, choose **Assign users and groups**.
+6. In the **Assign users or groups** page, select the different users and groups you want to assign to Airflow.
+ You can also search users and groups.
+ You can specify multiple users or groups by selecting the applicable accounts as they appear in search results.
+7. Choose **Assign users**.
+
+Manage user permissions through Amazon Verified Permissions
+===========================================================
+
+AWS auth manager uses Amazon Verified Permissions to define and verify user permissions.
+It uses `Cedar language <https://www.cedarpolicy.com/>`__ to define fine-grained permissions for users.
+AWS auth manager uses one policy store to store all policies related to the Airflow environment.
+To manage these policies, please follow the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Policies**.
+4. On the **Policies** page, you can see the list of policies. To create a new policy, please follow steps below.
+
+ a. Choose **Create policy**.
+ b. Under **Create policy**, choose **Create static policy**.
+
+Policy format
+-------------
+
+Policies are defined using Cedar language in Amazon Verified Permissions.
+For a complete documentation, `see cedar language website <https://www.cedarpolicy.com/>`__.
+In cedar language, a policy is composed of three elements:
+
+* **Principal**. Who is making the request?
+* **Action**. What operation does the principal want to perform?
+* **Resource**. What does the principal want to perform the action on?
+
+Each of these three elements can have limited values in the context of the Airflow environment.
Review Comment:
Each of these three elements allow only a specific set of valued in the context...
##########
docs/apache-airflow-providers-amazon/auth-manager/manage/index.rst:
##########
@@ -18,3 +18,205 @@
================================================
Manage Airflow environment with AWS auth manager
================================================
+
+When the AWS auth manager is used, all users and their permissions are no longer managed by
+Airflow itself but by AWS through two different services: AWS IAM Identity Center (users) and Amazon Verified
+Permissions (permissions).
+
+Manage users through AWS IAM Identity Center
+============================================
+
+Users
+-----
+
+All users having access to the Airflow environment must be defined in AWS IAM Identity Center.
+You can use AWS IAM Identity center as identity source or as a proxy between the identity source
+(e.g. Active Directory) and the Airflow environment.
+`See documentation for more details on how to manage your identity source <https://docs.aws.amazon.com/singlesignon/latest/userguide/identities.html>`__.
+
+You can see the list of users defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Users**.
+
+Groups
+------
+
+You can use groups in AWS IAM Identity center to group users in logical entities (e.g. by team, by department, ...).
+Later, these groups can be used in Amazon Verified Permissions to assign permissions to a group of users.
+`See documentation to add users to groups <https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html>`__.
+
+You can see the list of groups defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Groups**.
+
+Assign users and groups to the Airflow environment
+--------------------------------------------------
+
+.. note::
+ All users and groups defined in AWS IAM Identity Center do not have automatically access to the Airflow environment.
+ You need to manually assign which user can access to Airflow.
+
+To assign users and groups to Airflow, please follow the steps below.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+
+.. note::
+ If you manage users in AWS Managed Microsoft AD, make sure that the IAM Identity Center console is using the AWS
+ Region where your AWS Managed Microsoft AD directory is located before taking the next step.
+
+2. Choose **Applications**.
+3. Choose the **Customer managed** tab.
+4. In the list of applications, choose the application name ``Airflow``.
+5. On the application details page, in the **Assigned users and groups** section, choose **Assign users and groups**.
+6. In the **Assign users or groups** page, select the different users and groups you want to assign to Airflow.
+ You can also search users and groups.
+ You can specify multiple users or groups by selecting the applicable accounts as they appear in search results.
+7. Choose **Assign users**.
+
+Manage user permissions through Amazon Verified Permissions
+===========================================================
+
+AWS auth manager uses Amazon Verified Permissions to define and verify user permissions.
+It uses `Cedar language <https://www.cedarpolicy.com/>`__ to define fine-grained permissions for users.
+AWS auth manager uses one policy store to store all policies related to the Airflow environment.
+To manage these policies, please follow the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Policies**.
+4. On the **Policies** page, you can see the list of policies. To create a new policy, please follow steps below.
+
+ a. Choose **Create policy**.
+ b. Under **Create policy**, choose **Create static policy**.
+
+Policy format
+-------------
+
+Policies are defined using Cedar language in Amazon Verified Permissions.
+For a complete documentation, `see cedar language website <https://www.cedarpolicy.com/>`__.
+In cedar language, a policy is composed of three elements:
+
+* **Principal**. Who is making the request?
+* **Action**. What operation does the principal want to perform?
+* **Resource**. What does the principal want to perform the action on?
+
+Each of these three elements can have limited values in the context of the Airflow environment.
+You can see the list of principals, actions and resources in the policy store schema by following the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Schema**.
+
+Example of policies
+-------------------
+
+Here are some example of policies you can define in Amazon Verified Permissions.
+You can use them as-is if they fit exactly your use case.
+You can also modify and/or combine them to create your owned tailor made policies.
+
+Give all permissions to specific user
Review Comment:
Thinking more about it, it would best if we give example of what would existing FAB roles (Admin, Op, User, Viewer, Public) be written as when the Airflow deployment manager using AWS Auth manager. Current examples cover Admin and Viewer only. Add these will allow deployment managers to easily achieve what's possible today and then modify from there.
##########
docs/apache-airflow-providers-amazon/auth-manager/manage/index.rst:
##########
@@ -18,3 +18,205 @@
================================================
Manage Airflow environment with AWS auth manager
================================================
+
+When the AWS auth manager is used, all users and their permissions are no longer managed by
+Airflow itself but by AWS through two different services: AWS IAM Identity Center (users) and Amazon Verified
Review Comment:
no longer managed by the Flask auth manager, which is default in Airflow, but by AWS-based authorization integration through...
##########
docs/apache-airflow-providers-amazon/auth-manager/manage/index.rst:
##########
@@ -18,3 +18,205 @@
================================================
Manage Airflow environment with AWS auth manager
================================================
+
+When the AWS auth manager is used, all users and their permissions are no longer managed by
+Airflow itself but by AWS through two different services: AWS IAM Identity Center (users) and Amazon Verified
+Permissions (permissions).
+
+Manage users through AWS IAM Identity Center
+============================================
+
+Users
+-----
+
+All users having access to the Airflow environment must be defined in AWS IAM Identity Center.
+You can use AWS IAM Identity center as identity source or as a proxy between the identity source
+(e.g. Active Directory) and the Airflow environment.
+`See documentation for more details on how to manage your identity source <https://docs.aws.amazon.com/singlesignon/latest/userguide/identities.html>`__.
+
+You can see the list of users defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Users**.
+
+Groups
+------
+
+You can use groups in AWS IAM Identity center to group users in logical entities (e.g. by team, by department, ...).
+Later, these groups can be used in Amazon Verified Permissions to assign permissions to a group of users.
+`See documentation to add users to groups <https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html>`__.
+
+You can see the list of groups defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Groups**.
+
+Assign users and groups to the Airflow environment
+--------------------------------------------------
+
+.. note::
+ All users and groups defined in AWS IAM Identity Center do not have automatically access to the Airflow environment.
+ You need to manually assign which user can access to Airflow.
+
+To assign users and groups to Airflow, please follow the steps below.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+
+.. note::
+ If you manage users in AWS Managed Microsoft AD, make sure that the IAM Identity Center console is using the AWS
+ Region where your AWS Managed Microsoft AD directory is located before taking the next step.
+
+2. Choose **Applications**.
+3. Choose the **Customer managed** tab.
+4. In the list of applications, choose the application name ``Airflow``.
+5. On the application details page, in the **Assigned users and groups** section, choose **Assign users and groups**.
+6. In the **Assign users or groups** page, select the different users and groups you want to assign to Airflow.
+ You can also search users and groups.
+ You can specify multiple users or groups by selecting the applicable accounts as they appear in search results.
+7. Choose **Assign users**.
+
+Manage user permissions through Amazon Verified Permissions
+===========================================================
+
+AWS auth manager uses Amazon Verified Permissions to define and verify user permissions.
+It uses `Cedar language <https://www.cedarpolicy.com/>`__ to define fine-grained permissions for users.
+AWS auth manager uses one policy store to store all policies related to the Airflow environment.
+To manage these policies, please follow the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Policies**.
+4. On the **Policies** page, you can see the list of policies. To create a new policy, please follow steps below.
+
+ a. Choose **Create policy**.
+ b. Under **Create policy**, choose **Create static policy**.
+
+Policy format
+-------------
+
+Policies are defined using Cedar language in Amazon Verified Permissions.
+For a complete documentation, `see cedar language website <https://www.cedarpolicy.com/>`__.
+In cedar language, a policy is composed of three elements:
+
+* **Principal**. Who is making the request?
+* **Action**. What operation does the principal want to perform?
+* **Resource**. What does the principal want to perform the action on?
+
+Each of these three elements can have limited values in the context of the Airflow environment.
+You can see the list of principals, actions and resources in the policy store schema by following the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Schema**.
+
+Example of policies
+-------------------
+
+Here are some example of policies you can define in Amazon Verified Permissions.
+You can use them as-is if they fit exactly your use case.
Review Comment:
"You can use them as-is if they fit exactly your use case"
unnecessary line
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org