This is an automated email from the ASF dual-hosted git repository.
o-nikolas pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 46ea26b769d Make Redshift system-test clusters non-public in
sql_to_s3/s3_to_sql (#69890)
46ea26b769d is described below
commit 46ea26b769d838688ffa7620dfdbd2f00a3b7223
Author: Sean Ghaeli <[email protected]>
AuthorDate: Tue Jul 14 17:54:29 2026 -0700
Make Redshift system-test clusters non-public in sql_to_s3/s3_to_sql
(#69890)
RedshiftCreateClusterOperator defaults publicly_accessible=True, so the
example_sql_to_s3 and example_s3_to_sql system tests created Redshift
clusters with public endpoints, triggering recurring AppSec Publicly
Accessible Database findings. Set publicly_accessible=False to match
example_redshift and example_redshift_s3_transfers, which already set it.
Note: these two tests, unlike example_redshift*, open a direct SQL
connection to the cluster endpoint (SqlToS3Operator / S3ToSqlOperator
via a redshift connection built from describe_clusters). With a
non-public endpoint the test worker must reach the cluster from inside
the VPC; verify the runner has in-VPC network access before relying on
this change.
Co-authored-by: Sean Ghaeli <[email protected]>
---
providers/amazon/tests/system/amazon/aws/example_s3_to_sql.py | 1 +
providers/amazon/tests/system/amazon/aws/example_sql_to_s3.py | 1 +
2 files changed, 2 insertions(+)
diff --git a/providers/amazon/tests/system/amazon/aws/example_s3_to_sql.py
b/providers/amazon/tests/system/amazon/aws/example_s3_to_sql.py
index e53c5657e02..df15e1ba0fd 100644
--- a/providers/amazon/tests/system/amazon/aws/example_s3_to_sql.py
+++ b/providers/amazon/tests/system/amazon/aws/example_s3_to_sql.py
@@ -115,6 +115,7 @@ with DAG(
cluster_identifier=redshift_cluster_identifier,
vpc_security_group_ids=[security_group_id],
cluster_subnet_group_name=cluster_subnet_group_name,
+ publicly_accessible=False,
cluster_type="single-node",
node_type="ra3.large",
master_username=DB_LOGIN,
diff --git a/providers/amazon/tests/system/amazon/aws/example_sql_to_s3.py
b/providers/amazon/tests/system/amazon/aws/example_sql_to_s3.py
index 657f36be007..cffda6c3ba0 100644
--- a/providers/amazon/tests/system/amazon/aws/example_sql_to_s3.py
+++ b/providers/amazon/tests/system/amazon/aws/example_sql_to_s3.py
@@ -122,6 +122,7 @@ with DAG(
cluster_identifier=redshift_cluster_identifier,
vpc_security_group_ids=[security_group_id],
cluster_subnet_group_name=cluster_subnet_group_name,
+ publicly_accessible=False,
cluster_type="single-node",
node_type="ra3.large",
master_username=DB_LOGIN,
