AWS.MWAA reference

CreateCliToken

Source: src/AWS/MWAA/CreateCliToken.ts

Runtime binding for airflow:CreateCliToken.

Bind an Environment inside a function runtime to mint short-lived (60-second) Apache Airflow CLI tokens — exchange the token against https://{WebServerHostname}/aws_mwaa/cli to run Airflow CLI commands. The CliToken is Redacted — unwrap it with Redacted.value when building the request. Provide the implementation with Effect.provide(AWS.MWAA.CreateCliTokenHttp).

CreateCliToken: Creating CLI Tokens

// init — bind the operation to the environment
const createCliToken = yield* AWS.MWAA.CreateCliToken(environment);

// runtime — mint a token and POST a CLI command to the webserver
const token = yield* createCliToken();
const response = yield* HttpClient.execute(
  HttpClientRequest.post(
    `https://${token.WebServerHostname}/aws_mwaa/cli`,
  ).pipe(
    HttpClientRequest.setHeader(
      "Authorization",
      `Bearer ${Redacted.value(token.CliToken!)}`,
    ),
    HttpClientRequest.bodyText("dags list -o json"),
  ),
);

CreateWebLoginToken

Source: src/AWS/MWAA/CreateWebLoginToken.ts

Runtime binding for airflow:CreateWebLoginToken.

Bind an Environment inside a function runtime to mint short-lived Apache Airflow web login tokens — exchange the token against https://{WebServerHostname}/aws_mwaa/aws-console-sso to open an authenticated Airflow UI session. The IAM grant is scoped to the Airflow RBAC role the session is mapped to (Admin by default — pass { airflowRole } to scope it down). The WebToken is Redacted — unwrap it with Redacted.value. Provide the implementation with Effect.provide(AWS.MWAA.CreateWebLoginTokenHttp).

CreateWebLoginToken: Creating Web Login Tokens

Mint a Web Login Token

// init — bind the operation to the environment (Admin session)
const createWebLoginToken = yield* AWS.MWAA.CreateWebLoginToken(environment);

// runtime — mint a token and build the SSO login URL
const token = yield* createWebLoginToken();
const loginUrl =
  `https://${token.WebServerHostname}/aws_mwaa/aws-console-sso` +
  `?login=true#${Redacted.value(token.WebToken!)}`;

Scope the Session to a Read-Only Airflow Role

const createViewerToken = yield* AWS.MWAA.CreateWebLoginToken(environment, {
  airflowRole: "Viewer",
});

Environment

Source: src/AWS/MWAA/Environment.ts

An Amazon Managed Workflows for Apache Airflow (MWAA) environment — a fully managed Apache Airflow deployment that runs your DAGs.

Environments take roughly 20-30 minutes to create and are billed hourly for the environment, workers, and schedulers while they exist. Each environment needs an S3 bucket for DAG code (versioned, public access blocked), an IAM execution role, and two private subnets in distinct Availability Zones with outbound internet access (via NAT gateway or VPC endpoints). Destroy environments you are not using.

Environment: Creating an Environment

Basic Environment

const environment = yield* Environment("Airflow", {
  executionRoleArn: role.roleArn,
  sourceBucketArn: bucket.bucketArn,
  dagS3Path: "dags",
  subnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
  airflowVersion: "2.10.3",
  environmentClass: "mw1.small",
  maxWorkers: 5,
});

Public Webserver with Logging

const environment = yield* Environment("Airflow", {
  executionRoleArn: role.roleArn,
  sourceBucketArn: bucket.bucketArn,
  dagS3Path: "dags",
  subnetIds: [privateSubnetA.subnetId, privateSubnetB.subnetId],
  webserverAccessMode: "PUBLIC_ONLY",
  loggingConfiguration: {
    schedulerLogs: { enabled: true, logLevel: "INFO" },
    workerLogs: { enabled: true, logLevel: "INFO" },
    taskLogs: { enabled: true, logLevel: "INFO" },
  },
  airflowConfigurationOptions: {
    "core.default_task_retries": "3",
  },
});

GetEnvironment

Source: src/AWS/MWAA/GetEnvironment.ts

Runtime binding for airflow:GetEnvironment.

Bind an Environment inside a function runtime to observe the environment’s live status, webserver URL, and last-update details — useful for health checks and for gating REST API calls on Status === "AVAILABLE". Provide the implementation with Effect.provide(AWS.MWAA.GetEnvironmentHttp).

GetEnvironment: Describing the Environment

// init — bind the operation to the environment
const getEnvironment = yield* AWS.MWAA.GetEnvironment(environment);

// runtime — observe live status
const result = yield* getEnvironment();
const healthy = result.Environment?.Status === "AVAILABLE";

InvokeRestApi

Source: src/AWS/MWAA/InvokeRestApi.ts

Runtime binding for airflow:InvokeRestApi (Airflow 2.4.3+).

Bind an Environment inside a function runtime to call the Apache Airflow REST API on the environment’s webserver — trigger DAG runs, list DAGs, inspect task instances, manage variables and connections — without minting tokens yourself. The IAM grant is scoped to the Airflow RBAC role the call is mapped to (Admin by default — pass { airflowRole } to scope it down). Provide the implementation with Effect.provide(AWS.MWAA.InvokeRestApiHttp).

InvokeRestApi: Invoking the Airflow REST API

List DAGs

// init — bind the operation to the environment
const invokeRestApi = yield* AWS.MWAA.InvokeRestApi(environment);

// runtime — GET /dags through the Airflow REST API
const result = yield* invokeRestApi({
  Method: "GET",
  Path: "/dags",
  QueryParameters: { paused: false },
});
const dags = result.RestApiResponse as { dags: { dag_id: string }[] };

Trigger a DAG Run

const run = yield* invokeRestApi({
  Method: "POST",
  Path: "/dags/my_dag/dagRuns",
  Body: { conf: { source: "lambda" } },
});