AWS mwaa documentation change
Summary
Changed 'see' to 'refer to' in multiple documentation links for consistency
Security assessment
The changes are purely stylistic modifications to documentation phrasing (changing 'see' to 'refer to'). No security vulnerabilities, configurations, or mitigations were added or modified. The references to execution role permissions, Secrets Manager usage, and VPC configurations were already present and unchanged in content.
Diff
diff --git a/mwaa/latest/userguide/t-create-update-environment.md b/mwaa/latest/userguide/t-create-update-environment.md index 42f0b28af..1408b287c 100644 --- a//mwaa/latest/userguide/t-create-update-environment.md +++ b//mwaa/latest/userguide/t-create-update-environment.md @@ -62 +62 @@ If it takes more than twenty minutes for your environment to install a new versi - 2. Check Apache Airflow logs. If you enabled Apache Airflow logs, verify your log groups were created successfully on the [Logs groups page](https://console.aws.amazon.com/cloudwatch/home#logsV2:log-groups) on the CloudWatch console. If you see blank logs, the most common reason is due to missing permissions in your execution role for CloudWatch or Amazon S3 where logs are written. To learn more, see [Execution role](./mwaa-create-role.html). + 2. Check Apache Airflow logs. If you enabled Apache Airflow logs, verify your log groups were created successfully on the [Logs groups page](https://console.aws.amazon.com/cloudwatch/home#logsV2:log-groups) on the CloudWatch console. If you see blank logs, the most common reason is due to missing permissions in your execution role for CloudWatch or Amazon S3 where logs are written. To learn more, refer to [Execution role](./mwaa-create-role.html). @@ -64 +64 @@ If it takes more than twenty minutes for your environment to install a new versi - 3. Check Apache Airflow configuration options. If you're using Secrets Manager, verify that the key-value pairs you specified as an Apache Airflow configuration option were configured correctly. To learn more, see [Configuring an Apache Airflow connection using a AWS Secrets Manager secret](./connections-secrets-manager.html). + 3. Check Apache Airflow configuration options. If you're using Secrets Manager, verify that the key-value pairs you specified as an Apache Airflow configuration option were configured correctly. To learn more, refer to [Configuring an Apache Airflow connection using a AWS Secrets Manager secret](./connections-secrets-manager.html). @@ -66 +66 @@ If it takes more than twenty minutes for your environment to install a new versi - 4. Check VPC network configuration. To learn more, see I tried to create an environment and it's stuck in the "Creating" state. + 4. Check VPC network configuration. To learn more, refer to I tried to create an environment and it's stuck in the "Creating" state. @@ -68 +68 @@ If it takes more than twenty minutes for your environment to install a new versi - 5. Check execution role permissions. An execution role is an AWS Identity and Access Management (IAM) role with a permissions policy that grants Amazon MWAA permission to invoke the resources of other AWS services (such as Amazon S3, CloudWatch, Amazon SQS, Amazon ECR) on your behalf. Your [Customer managed key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk) or [AWS owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk) also needs to be permitted access. To learn more, see [Execution role](./mwaa-create-role.html). + 5. Check execution role permissions. An execution role is an AWS Identity and Access Management (IAM) role with a permissions policy that grants Amazon MWAA permission to invoke the resources of other AWS services (such as Amazon S3, CloudWatch, Amazon SQS, Amazon ECR) on your behalf. Your [Customer managed key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk) or [AWS owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk) also needs to be permitted access. To learn more, refer to [Execution role](./mwaa-create-role.html). @@ -70 +70 @@ If it takes more than twenty minutes for your environment to install a new versi - 6. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, see the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. + 6. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, refer to the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. @@ -83 +83 @@ Starting with Apache Airflow v2.2.2, Amazon MWAA supports installing plugins on -For more information about version management, and upgrading your existing environments, see [Apache Airflow versions on Amazon Managed Workflows for Apache Airflow](./airflow-versions.html). +For more information about version management, and upgrading your existing environments, refer to [Apache Airflow versions on Amazon Managed Workflows for Apache Airflow](./airflow-versions.html). @@ -116 +116 @@ Substitute the sample placeholders in `amzn-s3-demo-bucket` with your Amazon S3 - 3. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, see the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. + 3. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, refer to the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. @@ -137 +137 @@ We recommend the following steps: - 3. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, see the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. + 3. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, refer to the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. @@ -146 +146 @@ We recommend the following steps: - 1. Check VPC network configuration. To learn more, see I tried to create an environment and it's stuck in the "Creating" state. + 1. Check VPC network configuration. To learn more, refer to I tried to create an environment and it's stuck in the "Creating" state. @@ -150 +150 @@ We recommend the following steps: - 3. Check execution role permissions. An execution role is an AWS Identity and Access Management (IAM) role with a permissions policy that grants Amazon MWAA permission to invoke the resources of other AWS services (such as Amazon S3, CloudWatch, Amazon SQS, Amazon ECR) on your behalf. Your [Customer managed key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk) or [AWS owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk) also needs to be permitted access. To learn more, see [Execution role](./mwaa-create-role.html). + 3. Check execution role permissions. An execution role is an AWS Identity and Access Management (IAM) role with a permissions policy that grants Amazon MWAA permission to invoke the resources of other AWS services (such as Amazon S3, CloudWatch, Amazon SQS, Amazon ECR) on your behalf. Your [Customer managed key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk) or [AWS owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk) also needs to be permitted access. To learn more, refer to [Execution role](./mwaa-create-role.html). @@ -152 +152 @@ We recommend the following steps: - 4. Check Apache Airflow logs. If you enabled Apache Airflow logs, verify your log groups were created successfully on the [Logs groups page](https://console.aws.amazon.com/cloudwatch/home#logsV2:log-groups) on the CloudWatch console. If you see blank logs, the most common reason is due to missing permissions in your execution role for CloudWatch or Amazon S3 where logs are written. To learn more, see [Execution role](./mwaa-create-role.html). + 4. Check Apache Airflow logs. If you enabled Apache Airflow logs, verify your log groups were created successfully on the [Logs groups page](https://console.aws.amazon.com/cloudwatch/home#logsV2:log-groups) on the CloudWatch console. If you see blank logs, the most common reason is due to missing permissions in your execution role for CloudWatch or Amazon S3 where logs are written. To learn more, refer to [Execution role](./mwaa-create-role.html). @@ -154 +154 @@ We recommend the following steps: - 5. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, see the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. + 5. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, refer to the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. @@ -156 +156 @@ We recommend the following steps: - 6. If you are using an Amazon VPC _without_ internet access, ensure that you've created an Amazon S3 gateway endpoint, and granted the minimum required permisions to Amazon ECR to access Amazon S3. To learn more about creating an Amazon S3 gateway endpoint, see the following: + 6. If you are using an Amazon VPC _without_ internet access, ensure that you've created an Amazon S3 gateway endpoint, and granted the minimum required permisions to Amazon ECR to access Amazon S3. To learn more about creating an Amazon S3 gateway endpoint, refer to the following: @@ -189 +189 @@ We recommend the following steps: - 1. Check VPC security group configuration. To learn more, see I tried to create an environment and it's stuck in the "Creating" state. + 1. Check VPC security group configuration. To learn more, refer to I tried to create an environment and it's stuck in the "Creating" state. @@ -191 +191 @@ We recommend the following steps: - 2. Confirm that any Apache Airflow packages you listed in the `requirements.txt` correspond to the Apache Airflow version you're running on Amazon MWAA. To learn more, see [Installing Python dependencies](./working-dags-dependencies.html). + 2. Confirm that any Apache Airflow packages you listed in the `requirements.txt` correspond to the Apache Airflow version you're running on Amazon MWAA. To learn more, refer to [Installing Python dependencies](./working-dags-dependencies.html). @@ -193 +193 @@ We recommend the following steps: - 3. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, see the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. + 3. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, refer to the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. @@ -217 +217 @@ We recommend the following steps: - 2. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, see the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. + 2. To run a troubleshooting script that checks the Amazon VPC network setup and configuration for your Amazon MWAA environment, refer to the [Verify Environment](https://github.com/awslabs/aws-support-tools/tree/master/MWAA) script in AWS Support Tools on GitHub. @@ -230 +230 @@ We recommend the following steps: - 1. Check user permissions. You may not have been granted access to a permissions policy that allows you to view the Apache Airflow UI. To learn more, see [Accessing an Amazon MWAA environment](./access-policies.html). + 1. Check user permissions. You may not have been granted access to a permissions policy that allows you to view the Apache Airflow UI. To learn more, refer to [Accessing an Amazon MWAA environment](./access-policies.html). @@ -232 +232 @@ We recommend the following steps: - 2. Check network access. This may be because you selected the **Private network** access mode. If the URL of your Apache Airflow UI is in the following format `387fbcn-8dh4-9hfj-0dnd-834jhdfb-vpce.c10.us-west-2.airflow.amazonaws.com`, it means that you're using _private routing_ for your Apache Airflow _Web server_. You can either update the Apache Airflow access mode to the **Public network** access mode, or create a mechanism to access the VPC endpoint for your Apache Airflow _Web server_. To learn more, see [Managing access to service-specific Amazon VPC endpoints on Amazon MWAA](./vpc-vpe-access.html). + 2. Check network access. This may be because you selected the **Private network** access mode. If the URL of your Apache Airflow UI is in the following format `387fbcn-8dh4-9hfj-0dnd-834jhdfb-vpce.c10.us-west-2.airflow.amazonaws.com`, it means that you're using _private routing_ for your Apache Airflow _Web server_. You can either update the Apache Airflow access mode to the **Public network** access mode, or create a mechanism to access the VPC endpoint for your Apache Airflow _Web server_. To learn more, refer to [Managing access to service-specific Amazon VPC endpoints on Amazon MWAA](./vpc-vpe-access.html).