AWS mwaa documentation change
Summary
Multiple documentation updates including grammar fixes, dependency conflict clarifications, and improved instructions for using plugins.zip to restrict access to sensitive files
Security assessment
The change clarifying that plugins.zip should be used for files you 'do not want to grant access to users that write DAGs' (line 169) improves documentation about security best practices for access control. This helps prevent accidental exposure of sensitive files like certificates, but does not address a specific known vulnerability.
Diff
diff --git a/mwaa/latest/userguide/best-practices-dependencies.md b/mwaa/latest/userguide/best-practices-dependencies.md index e74f77638..e7d5bfd30 100644 --- a//mwaa/latest/userguide/best-practices-dependencies.md +++ b//mwaa/latest/userguide/best-practices-dependencies.md @@ -46 +46 @@ This topic describes how to install and manage Python dependencies in a `require - * The CLI builds a Docker container image locally that’s similar to an Amazon MWAA production image. This allows you to run a local Apache Airflow environment to develop and test DAGs, custom plugins, and dependencies before deploying to Amazon MWAA. + * The CLI builds a Docker container image locally that’s similar to an Amazon MWAA production image. You can use this to run a local Apache Airflow environment to develop and test DAGs, custom plugins, and dependencies before deploying to Amazon MWAA. @@ -76 +76 @@ For information about the version of Python compatible with your Apache Airflow -If the constraints file determines that `xyz==1.0` package is not compatible with other packages in your environment, `pip3 install` will fail in order to prevent incompatible libraries from being installed to your environment. If installation fails for any packages, you can access error logs for each Apache Airflow component (the scheduler, worker, and webserver) in the corresponding log stream on CloudWatch Logs. For more information about log types, refer to [Accessing Airflow logs in Amazon CloudWatch](./monitoring-airflow.html). +If the constraints file determines that `xyz==1.0` package is not compatible with other packages in your environment, `pip3 install` fails to prevent incompatible libraries from being installed to your environment. If installation fails for any packages, you can access error logs for each Apache Airflow component (the scheduler, worker, and webserver) in the corresponding log stream on CloudWatch Logs. For more information about log types, refer to [Accessing Airflow logs in Amazon CloudWatch](./monitoring-airflow.html). @@ -95 +95 @@ This example is provided for demonstration purposes. The boto and psycopg2-binar -If a package is specified without a version, Amazon MWAA installs the latest version of the package from [PyPi.org](https://pypi.org). This version might conflict with other packages in your `requirements.txt`. +If a package is specified without a version, Amazon MWAA installs the latest version of the package from [PyPi.org](https://pypi.org). This version can conflict with other packages in your `requirements.txt`. @@ -105 +105 @@ Apache Airflow v2 - 2. **Review the Apache Airflow package extras**. To access a list of the packages installed for Apache Airflow v2 on Amazon MWAA, refer to [aws-mwaa-docker-images `requirements.txt`](https://github.com/aws/amazon-mwaa-docker-images/blob/main/requirements.txt) on the GitHub website. + 2. **Review the Apache Airflow package extras**. To access a list of the packages installed for Apache Airflow v2 on Amazon MWAA, access [aws-mwaa-docker-images `requirements.txt`](https://github.com/aws/amazon-mwaa-docker-images/blob/main/requirements.txt) on the GitHub website. @@ -117 +117 @@ For information about the version of Python compatible with your Apache Airflow -If the constraints file determines that `xyz==1.0` package is not compatible with other packages in your environment, `pip3 install` will fail in order to prevent incompatible libraries from being installed to your environment. If installation fails for any packages, you can access error logs for each Apache Airflow component (the scheduler, worker, and webserver) in the corresponding log stream on CloudWatch Logs. For more information about log types, refer to [Accessing Airflow logs in Amazon CloudWatch](./monitoring-airflow.html). +If the constraints file determines that `xyz==1.0` package is not compatible with other packages in your environment, `pip3 install` fails to prevent incompatible libraries from being installed to your environment. If installation fails for any packages, you can access error logs for each Apache Airflow component (the scheduler, worker, and webserver) in the corresponding log stream on CloudWatch Logs. For more information about log types, refer to [Accessing Airflow logs in Amazon CloudWatch](./monitoring-airflow.html). @@ -136 +136 @@ This example is provided for demonstration purposes. The boto and psycopg2-binar -If a package is specified without a version, Amazon MWAA installs the latest version of the package from [PyPi.org](https://pypi.org). This version might conflict with other packages in your `requirements.txt`. +If a package is specified without a version, Amazon MWAA installs the latest version of the package from [PyPi.org](https://pypi.org). This version can conflict with other packages in your `requirements.txt`. @@ -169 +169 @@ We recommend the following methods to install Python dependencies from a Python -The Apache Airflow scheduler, workers, and webserver (for Apache Airflow v2.2.2 and later) search for custom plugins during startup on the AWS-managed Fargate container for your environment at `/usr/local/airflow/plugins/`*``. This process begins prior to Amazon MWAA's `pip3 install -r requirements.txt` for Python dependencies and Apache Airflow service startup. A `plugins.zip` file be used for any files that you don't want continuously changed during environment execution, or that you might not want to grant access to users that write DAGs. For example, Python library wheel files, certificate PEM files, and configuration YAML files. +The Apache Airflow scheduler, workers, and webserver (for Apache Airflow v2.2.2 and later) search for custom plugins during startup on the AWS-managed Fargate container for your environment at `/usr/local/airflow/plugins/`*``. This process begins prior to Amazon MWAA's `pip3 install -r requirements.txt` for Python dependencies and Apache Airflow service startup. A `plugins.zip` file can be used for any files that you don't want continuously changed during environment execution, or that you do not want to grant access to users that write DAGs. For example, Python library wheel files, certificate PEM files, and configuration YAML files. @@ -241 +241 @@ After running the DAG, use this new file as your Amazon MWAA `plugins.zip`, opti -This method allows you to use the same libraries offline. +This method you can use to use the same libraries offline. @@ -293 +293 @@ You can access Apache Airflow logs for the scheduler scheduling your workflows a - 6. Review the list of packages and whether any of these encountered an error during installation. If something went wrong, you might get an error similar to the following: + 6. Review the list of packages and whether any of these encountered an error during installation. If something went wrong, you can get an error similar to the following: @@ -304 +304 @@ You can access Apache Airflow logs for the scheduler scheduling your workflows a -You might also want to check your Apache Airflow UI to identify whether an error might be related to another issue. The most common error you might encounter with Apache Airflow on Amazon MWAA is: +You can also check your Apache Airflow UI to identify whether an error is related to another issue. The most common error you can encounter with Apache Airflow on Amazon MWAA is: