You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2022/07/27 00:19:53 UTC
[GitHub] [airflow] ReadytoRocc opened a new issue, #25326: The AWS Secrets Backends (SM and SSM) do not allow access via Assume Role Methods
ReadytoRocc opened a new issue, #25326:
URL: https://github.com/apache/airflow/issues/25326
### Description
My current understanding, is that the methods documented [here](https://docs.aws.amazon.com/cli/latest/topic/config-vars.html#credentials) outline the ways we can authorize AWS Secrets Manager or AWS Systems Manager as a [Secrets Backend](https://airflow.apache.org/docs/apache-airflow/2.3.3/security/secrets/secrets-backend/index.html). This does not include the Assume Role methods offered in the **[AWSBaseHook](https://github.com/apache/airflow/blob/main/airflow/providers/amazon/aws/hooks/base_aws.py#L609)**. I am prosing we extend the Secrets Backend integrations, so that they can use Assume Role methods to connect to these services.
### Use case/motivation
This would enable different authorization methods when connecting to AWS Secrets Backends. This could reduce the number of cases where users need to deploy Access & Secret Keys to their Airflow environment.
On K8s for example example, users could use the Role of the Worker or Scheduler Pod (once authorized) to connect to the service powering their Secrets Backend.
### Related issues
_No response_
### Are you willing to submit a PR?
- [X] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] ferruzzi commented on issue #25326: The AWS Secrets Backends (SM and SSM) do not allow configuration of Assume Role Methods via Backend Kwargs
Posted by GitBox <gi...@apache.org>.
ferruzzi commented on issue #25326:
URL: https://github.com/apache/airflow/issues/25326#issuecomment-1198399602
@potiuk - I appreciate the ping. I'm not familiar enough with the Secrets Backend yet to have any useful opinion on this one. At face value, it sounds like a useful addition, but I can't predict any unintended side-effects at this time. :+1:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk closed issue #25326: The AWS Secrets Backends (SM and SSM) do not allow configuration of Assume Role Methods via Backend Kwargs
Posted by GitBox <gi...@apache.org>.
potiuk closed issue #25326: The AWS Secrets Backends (SM and SSM) do not allow configuration of Assume Role Methods via Backend Kwargs
URL: https://github.com/apache/airflow/issues/25326
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] o-nikolas commented on issue #25326: The AWS Secrets Backends (SM and SSM) do not allow configuration of Assume Role Methods via Backend Kwargs
Posted by GitBox <gi...@apache.org>.
o-nikolas commented on issue #25326:
URL: https://github.com/apache/airflow/issues/25326#issuecomment-1211434991
I reviewed the linked PR #25628 and left some feedback :+1:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] Taragolis commented on issue #25326: The AWS Secrets Backends (SM and SSM) do not allow configuration of Assume Role Methods via Backend Kwargs
Posted by GitBox <gi...@apache.org>.
Taragolis commented on issue #25326:
URL: https://github.com/apache/airflow/issues/25326#issuecomment-1196877457
> This does not include the Assume Role methods and configuration framework offered by the [AWSBaseHook](https://github.com/apache/airflow/blob/main/airflow/providers/amazon/aws/hooks/base_aws.py#L609). I am proposing we extend the Secrets Backend integrations, so that they can be configured in a similar manner.
Right now almost everything related to `boto3.session.Session` in Hooks managed by [airflow.providers.amazon.aws.hooks.base_aws.BaseSessionFactory](https://github.com/apache/airflow/blob/4e50ea4df0cfa0e38c4217300d15999148910def/airflow/providers/amazon/aws/hooks/base_aws.py#L56) or [Custom Session Factory](https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/connections/aws.html#session-factory). The downside of this - Factory expect Airflow Connection, and as workaround might be possible to create Fake Airflow Connection and use it for obtain credentials.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on issue #25326: The AWS Secrets Backends (SM and SSM) do not allow configuration of Assume Role Methods via Backend Kwargs
Posted by GitBox <gi...@apache.org>.
potiuk commented on issue #25326:
URL: https://github.com/apache/airflow/issues/25326#issuecomment-1196518687
Feel free . Also @o-nikolas and @ferruzzi and @vincbeck might want to chime-in
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org