EndPoint Connection Error while connecting to AWS SecretManager from MWAA

Please ensure that the Secrets Manager endpoint is accessible via PrivateLink, Internet Gateway (IGW), and/or other routing, and that security groups and endpoint policies allow access, as well as that the MWAA execution IAM role is authorized to access Secrets Manager.

Logs looks like connection error , usually hooks use aws_default connection to connect secretes manager or any AWS service ( if you use operator hook to connect). I believe your environment is private with out NAT , in such case connecting to endpoint secretsmanager.secretsmanager.amazonaws.com use public IP and it will not receive response from secretsmanager.secretsmanager.amazonaws.com as a workaround you can use endpoint secretsmanager.{region}.amazonaws.com (secretsmanager.us-east-2.amazonaws.com ) to communicate.

procedure to regional endpoint this :

1. Update connection in webUI-->Connection-->AWS_Default-->Extras {"role_arn":"arn:aws:iam::AccountID:Role/rolename","region_name":"region like us-east-2"}

or

2. Create a new connection with name aws-newdefault with connection type " aws web service" and in extras, provide below . {"role_arn":"arn:aws:iam::AccountID:Role/rolename","region_name":"region like us-east-2"}

and in your task code make sure you use conn_id=aws-newdefault

If your environment is not private then you need to make sure if there are no restrictions in networks like policies , NACL,SG ,TGW etc or do partial testing by creating Ec2 instance using same VPC and SG . SSH to ec2 and try to do telnet, Dig, nc with and without region to make sure your network is good.

Telnet secretsmanager.amazonaws.com telnet secretsmanager.amazonaws.com 443 nc -v secretsmanager.amazonaws.com 443 ping secretsmanager.amazonaws.com

similarly do above for secretsmanager.us-east-2.amazonaws.com

if you still see issue , I would suggest to open a support case.