MWAA retrieving aws_default connection from Secrets Manager millions of times per month

Question

We have a small environment (~30 DAGs) running Airflow 2.2.2 with Secrets Manager as our secrets backend. We noticed once we switched to Secrets Manager that MWAA was retrieving the aws_default connection from Secrets Manager multiple times per second.

After digging into the logs, it seems to be the scheduler making all the calls but I'm not sure if that's normal behavior or what needs to change in our configuration to get the environment to search elsewhere for the execution role credentials.

Answer

You can control the  Secrets Manager API call by MWAA by having "connections_lookup_pattern" with "secrets.backend_kwargs" configuration.

Configuring an Apache Airflow connection using a AWS Secrets Manager secret - Step two: Create the Secrets Manager backend as an Apache Airflow configuration option - https://docs.aws.amazon.com/mwaa/latest/userguide/connections-secrets-manager.html#connections-sm-aa-configuration

https://airflow.apache.org/docs/apache-airflow-providers-amazon/7.3.0/_api/airflow/providers/amazon/aws/secrets/secrets_manager/index.html

Note if you are using the 7.3 provider version and you are on private you will need to update it in your plugins.zip. Do not follow instructions that tell you to put a constraints.txt in you dags folder it will not upload and will crash your EVN.

Answer

Every time a boto session is created many log lines are added regarding how the session was
constructed. Looks like change has been pushed to change the logging to debug . please find  
https://github.com/apache/airflow/pull/20858

MWAA retrieving aws_default connection from Secrets Manager millions of times per month

相關內容