You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "justinpakzad (via GitHub)" <gi...@apache.org> on 2026/04/23 02:11:15 UTC
[PR] fix: prevent unauthorized access to team-scoped secrets in SM and SSM… [airflow]
justinpakzad opened a new pull request, #65703:
URL: https://github.com/apache/airflow/pull/65703
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
<!--
Thank you for contributing!
Please provide above a brief description of the changes made in this pull request.
Write a good git commit message following this guide: http://chris.beams.io/posts/git-commit/
Please make sure that your code changes are covered with tests.
And in case of new features or big changes remember to adjust the documentation.
Feel free to ping (in general) for the review if you do not see reaction for a few days
(72 Hours is the minimum reaction time you can expect from volunteers) - we sometimes miss notifications.
In case of an existing issue, reference it using one of the following:
* closes: #ISSUE
* related: #ISSUE
-->
---
Updates off the back of #65395 & #65396 where it was pointed out that there could be a potential security issue. For example, a caller without team context could pass `conn_id="my_team/conn"` and resolve to `airflow/connections/my_team/conn`, the same path as my_team's actual secret.
`SecretsManagerBackend` and `SystemsManagerParameterStoreBackend` now use `--` as the separator between `team_name` and `secret_id`. Path is now `{prefix}/{team_name}--{secret_id}` when `team_name` is passed, otherwise `{prefix}/{secret_id}` as before. Also added a check so if there's no team context but the `secret_id` looks team-shaped (e.g. `my_team--conn`), we return `None` instead of looking it up, similar pattern as the env var backend.
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR, please
change below checkbox to `[X]` followed by the name of the tool, uncomment the "Generated-by".
-->
- [x] Yes (Claude Sonnet 4.6)
<!--
Generated-by: [Tool Name] following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
-->
---
* Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Prevent unauthorized access to team-scoped secrets in SM and SSM [airflow]
Posted by "o-nikolas (via GitHub)" <gi...@apache.org>.
o-nikolas commented on code in PR #65703:
URL: https://github.com/apache/airflow/pull/65703#discussion_r3150201274
##########
providers/amazon/src/airflow/providers/amazon/aws/secrets/secrets_manager.py:
##########
@@ -316,3 +302,32 @@ def _get_secret(
exc_info=True,
)
return None
+
+ def _get_secret(
+ self, path_prefix, secret_id: str, lookup_pattern: str | None, team_name: str | None = None
+ ) -> str | None:
+ """
+ Get secret value from Secrets Manager.
+
+ :param path_prefix: Prefix for the Path to get Secret
+ :param secret_id: Secret Key
+ :param lookup_pattern: If provided, `secret_id` must match this pattern to look up the secret in
+ Secrets Manager
+ :param team_name: Team name associated to the task trying to access the variable (if any)
+ """
+ if lookup_pattern and not re.match(lookup_pattern, secret_id, re.IGNORECASE):
+ return None
+ if team_name is None and re.fullmatch(r"[^-]+--.+", secret_id):
+ return None
Review Comment:
Should we log some kind of exception or message here? This fails pretty silently
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: prevent unauthorized access to team-scoped secrets in SM and SSM [airflow]
Posted by "justinpakzad (via GitHub)" <gi...@apache.org>.
justinpakzad commented on PR #65703:
URL: https://github.com/apache/airflow/pull/65703#issuecomment-4308367403
> Nice! Can I ask you to update the documentation of these secret backend to briefly explain how to use them with multi-team mode?
Sure thing, will update the docs. I'm seeing some of the other PRs (e.g. #65692) have the global fallback, where if the team-scoped secret isn't found it falls back to the global path. I didn't do that here. Should we be doing the same with these?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Prevent unauthorized access to team-scoped secrets in SM and SSM [airflow]
Posted by "shahar1 (via GitHub)" <gi...@apache.org>.
shahar1 merged PR #65703:
URL: https://github.com/apache/airflow/pull/65703
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: prevent unauthorized access to team-scoped secrets in SM and SSM [airflow]
Posted by "justinpakzad (via GitHub)" <gi...@apache.org>.
justinpakzad commented on PR #65703:
URL: https://github.com/apache/airflow/pull/65703#issuecomment-4316425071
Just updated the PR. Added the global fallback if the team lookup doesn't yield any results, two more tests cases to ensure the fallback is working as expected, and updated both docs. If you can have another look whenever you have time, that would be great. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: prevent unauthorized access to team-scoped secrets in SM and SSM [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on PR #65703:
URL: https://github.com/apache/airflow/pull/65703#issuecomment-4313968090
> > Nice! Can I ask you to update the documentation of these secret backend to briefly explain how to use them with multi-team mode?
>
> Sure thing, will update the docs. I'm seeing some of the other PRs (e.g. #65692) have the global fallback, where if the team-scoped secret isn't found it falls back to the global path. I didn't do that here. Should we be doing the same with these?
Good catch! Yes please
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix: prevent unauthorized access to team-scoped secrets in SM and SSM… [airflow]
Posted by "justinpakzad (via GitHub)" <gi...@apache.org>.
justinpakzad commented on PR #65703:
URL: https://github.com/apache/airflow/pull/65703#issuecomment-4301289545
cc @vincbeck
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Prevent unauthorized access to team-scoped secrets in SM and SSM [airflow]
Posted by "justinpakzad (via GitHub)" <gi...@apache.org>.
justinpakzad commented on code in PR #65703:
URL: https://github.com/apache/airflow/pull/65703#discussion_r3150414602
##########
providers/amazon/src/airflow/providers/amazon/aws/secrets/secrets_manager.py:
##########
@@ -316,3 +302,32 @@ def _get_secret(
exc_info=True,
)
return None
+
+ def _get_secret(
+ self, path_prefix, secret_id: str, lookup_pattern: str | None, team_name: str | None = None
+ ) -> str | None:
+ """
+ Get secret value from Secrets Manager.
+
+ :param path_prefix: Prefix for the Path to get Secret
+ :param secret_id: Secret Key
+ :param lookup_pattern: If provided, `secret_id` must match this pattern to look up the secret in
+ Secrets Manager
+ :param team_name: Team name associated to the task trying to access the variable (if any)
+ """
+ if lookup_pattern and not re.match(lookup_pattern, secret_id, re.IGNORECASE):
+ return None
+ if team_name is None and re.fullmatch(r"[^-]+--.+", secret_id):
+ return None
Review Comment:
Good shout. It is explicitly mentioned in the docs that the pattern is reserved for team-scoped look ups but maybe logging a warning might be useful? Happy to add that in.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org