MWAA Generated CLI Token Returns a 403 After A Successful Cli Token Generation

Question

Description

Code

from datetime import datetime

import requests
import boto3

TODAYS_DATE = datetime.now()

def main():
    mwaa_client = boto3.client('mwaa')
    response = mwaa_client.create_cli_token(Name="dev-main-mwaa-env")

    headers = {
        'Authorization': response["CliToken"],
        'Content-Type': 'text/plain'
    }

    dag_to_run = f"test_dag"

    mwaa_hostname = f'https://{response["WebServerHostname"]}/aws_mwaa/cli'

    # NOTE: The execution date is a required part of the call. I'm unsure
    #       why they didn't accept the run_id.
    dag_status_response = requests.post(
        mwaa_hostname,
        headers=headers,
        data=f"dags state {dag_to_run} {TODAYS_DATE.isoformat()}")

    tasks_states_response = requests.post(
        mwaa_hostname,
        headers=headers,
        data=f"tasks states-for-dag-run -o json {dag_to_run} {TODAYS_DATE.isoformat()}")
    breakpoint()

if __name__ == "__main__":
    main()

PDB Reproduction

(Pdb) ll
  8     def main():
  9         mwaa_client = boto3.client('mwaa')
 10         response = mwaa_client.create_cli_token(Name="dev-main-mwaa-env")                                                                                                                                                                                                                                                                                11
 12         headers = {
 13             'Authorization': response["CliToken"],
 14             'Content-Type': 'text/plain'
 15         }
 16
 17         dag_to_run = f"test_dag"
 18
 19         mwaa_hostname = f'https://{response["WebServerHostname"]}/aws_mwaa/cli'
 20
 21         dag_status_response = requests.post(
 22             mwaa_hostname,
 23             headers=headers,
 24             data=f"dags state {dag_to_run} {TODAYS_DATE.isoformat()}")
 25
 26         tasks_states_response = requests.post(
 27             mwaa_hostname,
 28             headers=headers,
 29             data=f"tasks states-for-dag-run -o json {dag_to_run} {TODAYS_DATE.isoformat()}")
 30  ->     breakpoint()
(Pdb) tasks_states_response
<Response [403]>
(Pdb) dag_status_response
<Response [403]>
(Pdb) headers

Answer 1

Fix

The core issue is in how I wrote the headers. Specifically going from

'Authorization': response["CliToken"],

to

'Authorization': f'Bearer {response["CliToken"]}',

This is even covered in the AWS MWAA doc I was reading for the example. I just plain missed it.