vincbeck opened a new issue, #65373:
URL: https://github.com/apache/airflow/issues/65373
### Description
In multi-team mode, Airflow passes `team_name` to the secrets backend when
retrieving connections and variables (via `get_conn_value`, `get_variable`, and
`get_connection` in `BaseSecretsBackend`). This allows backends to scope
secrets per team — for example, by looking up parameters under a team-specific
path prefix.
Currently, `SystemsManagerParameterStoreBackend` accepts `team_name` in its
`get_conn_value` and `get_variable` signatures but completely ignores it. The
`team_name` is never forwarded to `_get_secret`, so all teams resolve
parameters from the same path regardless of team context.
### Expected behavior
When `team_name` is provided, `SystemsManagerParameterStoreBackend` should
incorporate it into the parameter lookup path. For example, with
`connections_prefix="/airflow/connections"` and `team_name="analytics"`, the
backend could look up `/airflow/connections/analytics/smtp_default` instead of
`/airflow/connections/smtp_default`.
When `team_name` is `None` (single-team mode or no team context), the
behavior should remain unchanged (`{prefix}/{secret_id}`).
### Current behavior
`team_name` is accepted in the method signatures but never used:
```python
def get_conn_value(self, conn_id: str, team_name: str | None = None) -> str
| None:
# team_name is ignored
return self._get_secret(self.connections_prefix, conn_id,
self.connections_lookup_pattern)
def get_variable(self, key: str, team_name: str | None = None) -> str | None:
# team_name is ignored
return self._get_secret(self.variables_prefix, key,
self.variables_lookup_pattern)
```
### What needs to change
1. **Pass `team_name` to `_get_secret`** — `get_conn_value` and
`get_variable` should forward `team_name` to `_get_secret`.
2. **Incorporate `team_name` into the parameter path** — `_get_secret` (or
`build_path`) should use `team_name` to construct a team-scoped path when
provided.
3. **Update tests** to cover team-scoped parameter lookups.
### Files likely to be modified
-
`providers/amazon/src/airflow/providers/amazon/aws/secrets/systems_manager.py`
- `providers/amazon/tests/unit/amazon/aws/secrets/test_systems_manager.py`
### Related
This is the same gap as in `SecretsManagerBackend` (see companion issue for
that backend).
### Use case
Operators running Airflow in multi-team mode with AWS SSM Parameter Store
cannot isolate parameters per team. All teams currently share the same
parameter namespace, which prevents proper secret scoping in multi-team
deployments.
### Use case/motivation
_No response_
### Related issues
_No response_
### Are you willing to submit a PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
