2

I am trying to create MWAA as root user and I have all AWS services (s3 and EMR )in North California. MWAA doesn't exist in North California. Hence created this in Oregon.

I am creating this in a private network, it also required a new s3 bucket in that region for my dags folder.

I see that it also needed a new vpc and private subnet as we dont have anything in that region created by clicking on "Create VPC ".

Now when I click on airflow UI. It says

"This site can’t be reached". Do I need to add my Ip to the security group here to access Airflow UI?

Someone, please guide.

Thanks, Xi

Xi12
  • 939
  • 2
  • 14
  • 27

2 Answers2

1

From AWS MWAA documentation:

3. Enable network access. You'll need to create a mechanism in your Amazon VPC to connect to the VPC endpoint (AWS PrivateLink) for your Apache Airflow Web server. For example, by creating a VPN tunnel from your computer using an AWS Client VPN.

Apache Airflow access modes (AWS)

The AWS documentation suggests 3 different approaches for accomplishing this (tutorials are linked in the documentation).

  1. Using an AWS Client VPN
  2. Using a Linux Bastion Host
  3. Using a Load Balancer (advanced)

Accessing the VPC endpoint for your Apache Airflow Web server (private network access)

Andrew Nguonly
  • 2,258
  • 1
  • 17
  • 23
0

It's difficult to say exactly why you cannot access it unless you provide more detail. With MWAA, there are several steps from your PC to Airflow.

  • If the error you get is from your browser, that means the AWS network that your MWAA is on is not accessible from the public internet
  • If the error is an AWS page, that means some of the authentication or networking of MWAA is misconfigured

If you've simply followed the normal wizard and created the VPC using the MWAA CloudFormation stack, then there's only one likely reason you cannot access it. In the MWAA configuration, under Networking, check Web server access. It should say Public network (Internet accessible). If it's set to Private network (No internet access) you will need an bastion to provide you with ingress to the MWAA network, which is mainly something you would do if you have very strict security needs. The public network is fine since it will still require an AWS login to access, and a lot easier than dealing with bastions.

Dommondke
  • 307
  • 1
  • 8