This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 2ebb8dd5d7b Verify S3 TLS certificates by default in
S3ToAzureBlobStorageOperator (#76222)
2ebb8dd5d7b is described below
commit 2ebb8dd5d7b17c97d06fa01d08f0611ef2fd4b1f
Author: Jarek Potiuk <[email protected]>
AuthorDate: Sun Nov 1 16:01:30 2026 +0100
Verify S3 TLS certificates by default in S3ToAzureBlobStorageOperator
(#76222)
s3_verify now defaults to None, so the S3 hook follows the connection /
botocore default (verification on), matching the documented behaviour and the
other AWS transfer operators. Pass s3_verify=False to keep the previous
behaviour.
Generated-by: Claude Opus 5
---
providers/microsoft/azure/docs/changelog.rst | 6 ++++++
.../src/airflow/providers/microsoft/azure/transfers/s3_to_wasb.py | 4 +++-
.../azure/tests/unit/microsoft/azure/transfers/test_s3_to_wasb.py | 4 ++--
3 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/providers/microsoft/azure/docs/changelog.rst
b/providers/microsoft/azure/docs/changelog.rst
index d20ae314a88..5e83b0a07db 100644
--- a/providers/microsoft/azure/docs/changelog.rst
+++ b/providers/microsoft/azure/docs/changelog.rst
@@ -27,6 +27,12 @@
Changelog
---------
+.. note::
+
+ ``S3ToAzureBlobStorageOperator`` now verifies S3 TLS certificates by
default: ``s3_verify`` defaults
+ to ``None``, deferring to the connection and botocore default. Pass
``s3_verify=False`` to keep the
+ previous behaviour.
+
15.3.0
......
diff --git
a/providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/s3_to_wasb.py
b/providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/s3_to_wasb.py
index b80cdb726bc..df8760c6c53 100644
---
a/providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/s3_to_wasb.py
+++
b/providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/s3_to_wasb.py
@@ -93,6 +93,8 @@ class S3ToAzureBlobStorageOperator(BaseOperator):
By default, SSL certificates are verified.
You can provide the following values:
+ - ``None`` (default): use the ``verify`` setting from the AWS
connection, falling back
+ to botocore's default, which verifies certificates.
- ``False``: do not validate SSL certificates. SSL will still be used
(unless use_ssl is False), but SSL certificates will not be
verified.
@@ -127,7 +129,7 @@ class S3ToAzureBlobStorageOperator(BaseOperator):
blob_name: str | None = None,
create_container: bool = False,
replace: bool = False,
- s3_verify: bool = False,
+ s3_verify: bool | str | None = None,
s3_extra_args: dict | None = None,
wasb_extra_args: dict | None = None,
**kwargs,
diff --git
a/providers/microsoft/azure/tests/unit/microsoft/azure/transfers/test_s3_to_wasb.py
b/providers/microsoft/azure/tests/unit/microsoft/azure/transfers/test_s3_to_wasb.py
index 4858e29a183..2cf6b92ccea 100644
---
a/providers/microsoft/azure/tests/unit/microsoft/azure/transfers/test_s3_to_wasb.py
+++
b/providers/microsoft/azure/tests/unit/microsoft/azure/transfers/test_s3_to_wasb.py
@@ -84,7 +84,7 @@ class TestS3ToAzureBlobStorageOperator:
assert operator.blob_name is None
assert not operator.create_container # Should be false (match default
value in constructor)
assert operator.replace
- assert not operator.s3_verify # Should be false (match default value
in constructor)
+ assert operator.s3_verify is None # Defer to the connection /
botocore default
assert operator.s3_extra_args == {}
assert operator.wasb_extra_args == {}
@@ -115,7 +115,7 @@ class TestS3ToAzureBlobStorageOperator:
assert sorted(uploaded_files) == sorted(MOCK_FILES)
# Using the default connection ID, along with the default value of
verify (for the S3 hook)
- s3_mock_hook.assert_called_once_with(aws_conn_id="aws_default",
verify=False)
+ s3_mock_hook.assert_called_once_with(aws_conn_id="aws_default",
verify=None)
wasb_mock_hook.assert_called_once_with(wasb_conn_id="wasb_default")
# There are a number of very similar tests that use the same mocking, and
for the most part, the same
