vincbeck opened a new issue, #65372:
URL: https://github.com/apache/airflow/issues/65372
### Description
In multi-team mode, Airflow passes `team_name` to the secrets backend when
retrieving connections and variables (via `get_conn_value`, `get_variable`, and
`get_connection` in `BaseSecretsBackend`). This allows backends to scope
secrets per team — for example, by looking up secrets under a team-specific
path prefix.
Currently, `SecretsManagerBackend` accepts `team_name` in its
`get_conn_value` and `get_variable` signatures but completely ignores it. The
`team_name` is never forwarded to `_get_secret`, so all teams resolve secrets
from the same path regardless of team context.
### Expected behavior
When `team_name` is provided, `SecretsManagerBackend` should incorporate it
into the secret lookup path. For example, with
`connections_prefix="airflow/connections"` and `team_name="analytics"`, the
backend could look up `airflow/connections/analytics/smtp_default` instead of
`airflow/connections/smtp_default`.
The exact path convention is an implementation decision, but a reasonable
approach would be to insert the team name between the prefix and the secret ID:
```
{prefix}/{team_name}/{secret_id}
```
When `team_name` is `None` (single-team mode or no team context), the
behavior should remain unchanged (`{prefix}/{secret_id}`).
### Current behavior
`team_name` is accepted in the method signatures but never used:
```python
def get_conn_value(self, conn_id: str, team_name: str | None = None) -> str
| None:
# team_name is ignored
secret = self._get_secret(self.connections_prefix, conn_id,
self.connections_lookup_pattern)
...
def get_variable(self, key: str, team_name: str | None = None) -> str | None:
# team_name is ignored
return self._get_secret(self.variables_prefix, key,
self.variables_lookup_pattern)
```
### What needs to change
1. **Pass `team_name` to `_get_secret`** — `get_conn_value` and
`get_variable` should forward `team_name` to `_get_secret`.
2. **Incorporate `team_name` into the secret path** — `_get_secret` (or
`build_path`) should use `team_name` to construct a team-scoped path when
provided.
3. **Update tests** to cover team-scoped secret lookups.
### Files likely to be modified
-
`providers/amazon/src/airflow/providers/amazon/aws/secrets/secrets_manager.py`
- `providers/amazon/tests/unit/amazon/aws/secrets/test_secrets_manager.py`
### Note
The same gap exists in `SystemsManagerParameterStoreBackend`
(`providers/amazon/src/airflow/providers/amazon/aws/secrets/systems_manager.py`)
and in other provider secrets backends (Google Secret Manager, Azure Key
Vault, HashiCorp Vault, Yandex Lockbox, Kubernetes). Those could be addressed
in follow-up issues.
### Use case
Operators running Airflow in multi-team mode with AWS Secrets Manager cannot
isolate secrets per team. All teams currently share the same secret namespace,
which prevents proper secret scoping in multi-team deployments.
### Use case/motivation
_No response_
### Related issues
_No response_
### Are you willing to submit a PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
