terraform-aws-mwaa

terraform-aws-mwaa copied to clipboard

Security issue: MWAA has more access than it needs

1

MWAA has `"eks:*"` access, but it does not need EKS access by default. It does not need S3 delete permissions by default either. Finally, I don't think it needs `batch`...

Almenon

I got the permission error with "airflow:ListEnvironments" and later "airflow:GetEnvironment". Also those permissions being added to policy with manual MWAA creation. Fix is lines 49, 50 in data.tf 

5e9148d9

Delete mwaa resource lifecycle block with ignore changes

5

### What does this PR do? This PR deletes lifecycle block from MWAA resource in order to update MWAA whenever requirements or plugins objects version changes. ### Motivation Motivation is...

arnoldasjan

Can you add output of VPC endpoint if it was create during environment provisioning ?

ajax-koval-i

var.source_bucket_name should be respected as the S3 bucket name and not the prefix

1

When setting `var.source_bucket_name`, it turns out that it's only setting the bucket name prefix (see [here](https://github.com/aws-ia/terraform-aws-mwaa/blob/bdf9b0432d92b20b717c890e876b8f74d75cb274/main.tf#L108)) and not the actual name of the bucket. I'm not sure why the behavior...

Chili-Man

iam_role_additional_policies and external IAM Roles

5

When bringing external iam role with below config ``` create_iam_role = false execution_role_arn = data.aws_iam_role.mwaa.arn iam_role_additional_policies = [] ``` TF throws below error ``` │ Error: Invalid object key │...

ZhijieWang

What is the intended deployment pattern for changing requirements and plugins?

6

I see that the lifecycle settings ignore changes to both the requirements and plugins objects ```tf lifecycle { ignore_changes = [ plugins_s3_object_version, requirements_s3_object_version ] } ``` Is there some kind...

easontm

I want to request a feature to enable setting KMS key for MWAA. It is required to use the same key for both S3 and MWAA instance and there will...

sleepwithcoffee

What's the easiest way to configure the log retention policy on MWAA cloudwatch logs? This module allows users to toggle the logs and configure the level but it doesn't seem...

ylhan

Remove s3 arn variable as a requirement

2

### What does this PR do? remove need of s3 arn variable, the data module provides the capability to get s3 arn from S3 Bucket Name ### Motivation This pull...

fossouo