error while accessing airflow ui

Question

Forbidden You don't have the permission to access the requested resource. It is either read-protected or not readable by the server.

getting this error when accessing aws airflow ui
created bastion for port forwarding as mwaa webserver is privateonly

mwaa_role = iam.Role(
            self,
            "MwaaExecutionRole",
            role_name=f"{airflow_env_name}-exec-role",
            assumed_by=iam.CompositePrincipal(
                iam.ServicePrincipal("airflow.amazonaws.com"),
                iam.ServicePrincipal("airflow-env.amazonaws.com"),
            ),
            path="/service-role/",
        )
   
        mwaa_role.add_managed_policy(
            iam.ManagedPolicy.from_aws_managed_policy_name("AmazonS3ReadOnlyAccess")
        )

dags_bucket.grant_read_write(mwaa_role)

mwaa_role.add_to_policy(
            iam.PolicyStatement(
                actions=[
                    "logs:CreateLogGroup",
                    "logs:CreateLogStream",
                    "logs:PutLogEvents",
                ],
                resources=["*"],
            )
        )
        mwaa_role.add_to_policy(
            iam.PolicyStatement(
                actions=[
                    "sqs:SendMessage",
                    "sqs:ReceiveMessage",
                    "sqs:DeleteMessage",
                    "sqs:GetQueueAttributes",
                    "sqs:GetQueueUrl",
                ],
                resources=["*"],
            )
        )

mwaa_role.add_to_policy(
            iam.PolicyStatement(
                actions=[
                    "secretsmanager:GetSecretValue",
                    "kms:Decrypt",
                    "sts:GetCallerIdentity",
                ],
                resources=["*"],
            )
        )

these are roles used for airflow in cdk code
please suggest for above error in cdk code

re:Post Agent · Answer

The "Forbidden" error you're encountering when accessing the Apache Airflow UI is likely due to missing IAM permissions. The issue is that your IAM role or user doesn't have the required permission to access the Airflow UI.

To fix this issue, you need to add the `airflow:CreateWebLoginToken` permission to the IAM role or user that you're using to access the Airflow UI. This permission is essential for generating the web login token required to access the Airflow web interface.

Add the following policy statement to your IAM role or user:

```python
iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["airflow:CreateWebLoginToken"],
resources=[f"arn:aws:airflow:{region}:{account_id}:role/{airflow_env_name}/Admin"]
)
```

Replace `region` with your AWS Region, `account_id` with your AWS account ID, and ensure `airflow_env_name` matches your environment name. The `/Admin` part specifies the RBAC role - you can use other roles like `Op`, `User`, `Viewer`, or `Public` depending on the level of access you need.

For your CDK code, you should add this permission to the IAM role or user that you're using to access the Airflow UI, not to the MWAA execution role that you've shown in your code. The execution role is for the Airflow environment itself, while you need to ensure your user/role has the proper permissions to access the UI.

If you're using a bastion host for port forwarding, also make sure that your network configuration allows access to the MWAA web server endpoint and that your VPC security groups, network ACLs, and route tables are properly configured.  
**Sources**  
[Troubleshoot Apache Airflow UI access issues in MWAA | AWS re:Post](https://repost.aws/knowledge-center/mwaa-airflow-access-issues)  
[CreateWebLoginToken - Amazon Managed Workflows for Apache Airflow](https://docs.aws.amazon.com/mwaa/latest/API/API_CreateWebLoginToken.html)  
[Troubleshooting: Creating and updating an Amazon MWAA environment - Amazon Managed Workflows for Apache Airflow](https://docs.aws.amazon.com/mwaa/latest/userguide/t-create-update-environment.html)

error while accessing airflow ui

Add your answer

Relevant content