Tutorial: Configuring private network access using a Linux Bastion Host

1. Check for user permissions. Be sure that your account in Amazon Identity and Access Management (IAM) has sufficient permissions to create and manage VPC resources.

2. Use your Amazon MWAA VPC. This tutorial assumes that you are associating the bastion host to an existing VPC. The Amazon VPC must be in the same region as your Amazon MWAA environment and have two private subnets, as defined in Create the VPC network.

3. Create an SSH key. You need to create an Amazon EC2 SSH key (.pem) in the same Region as your Amazon MWAA environment to connect to the virtual servers. If you don't have an SSH key, see Create or import a key pair in the Amazon EC2 User Guide.

1. Create a Linux Bastion Host instance using a Amazon CloudFormation template for an existing VPC.

2. Authorize inbound traffic to the bastion instance's security group using an ingress rule on port 22.

3. Authorize inbound traffic from an Amazon MWAA environment's security group to the bastion instance's security group.

4. Create an SSH tunnel to the bastion instance.

5. Install and configure the FoxyProxy add-on for the Firefox browser to view the Apache Airflow UI.

To create the Linux Bastion Host

1. Open the Deploy Quick Start page on the Amazon CloudFormation console.

2. Use the region selector in the navigation bar to choose the same Amazon Region as your Amazon MWAA environment.

3. Choose Next.

4. Type a name in the Stack name text field, such as mwaa-linux-bastion.

5. On the Parameters, Network configuration pane, choose the following options:

   1. Choose your Amazon MWAA environment's VPC ID.

   2. Choose your Amazon MWAA environment's Public subnet 1 ID.

   3. Choose your Amazon MWAA environment's Public subnet 2 ID.

   4. Enter the narrowest possible address range (for example, an internal CIDR range) in Allowed bastion external access CIDR.

      Note

      The simplest way to identify a range is to use the same CIDR range as your public subnets. For example, the public subnets in the Amazon CloudFormation template on the Create the VPC network page are 10.192.10.0/24 and 10.192.11.0/24.

6. On the Amazon EC2 configuration pane, choose the following:

   1. Choose your SSH key in the dropdown list in Key pair name.

   2. Enter a name in Bastion Host Name.

   3. Choose true for TCP forwarding.

      Warning

      TCP forwarding must be set to true in this step. Otherwise, you won't be able to create an SSH tunnel in the next step.

7. Choose Next, Next.

8. Select the acknowledgement, and then choose Create stack.

1. Open the Environments page on the Amazon MWAA console.

2. Choose an environment.

3. On the Networking pane, choose VPC security group.

4. Choose Edit inbound rules.

5. Choose Add rule.

6. Choose your VPC security group ID in the Source dropdown list.

7. Leave the remaining options blank, or set to their default values.

8. Choose Save rules.

1. Open the Environments page on the Amazon MWAA console.

2. Choose an environment.

3. Copy the URL in Airflow UI for subsequent steps.

1. Open a new command prompt window.

2. Type the following command to open an SSH tunnel.

   ssh -i mykeypair.pem -N -L 8157:YOUR_VPC_ENDPOINT_ID-vpce.YOUR_REGION.airflow.amazonaws.com:443 ubuntu@YOUR_PUBLIC_IPV4_DNS.YOUR_REGION.compute.amazonaws.com

   -L signifies the use of local port forwarding which allows you to specify a local port used to forward data to the identified remote port on the node's local web server.

3. Type http://localhost:8157/ in your browser.

   Note

   You may need to use https://localhost:8157/.

1. In Firefox, open the FoxyProxy Standard extension page.

2. Choose Add to Firefox.

3. Choose Add.

4. Choose the FoxyProxy icon in your browser's toolbar, choose Options.

5. Copy the following code and save locally as mwaa-proxy.json. Substitute the sample value in YOUR_HOST_NAME with your Apache Airflow URL.

   {
     "e0b7kh1606694837384": {
       "type": 3,
       "color": "#66cc66",
       "title": "airflow",
       "active": true,
       "address": "localhost",
       "port": 8157,
       "proxyDNS": false,
       "username": "",
       "password": "",
       "whitePatterns": [
         {
           "title": "airflow-ui",
           "pattern": "YOUR_HOST_NAME",
           "type": 1,
           "protocols": 1,
           "active": true
         }
       ],
       "blackPatterns": [],
       "pacURL": "",
       "index": -1
     },
     "k20d21508277536715": {
       "active": true,
       "title": "Default",
       "notes": "These are the settings that are used when no patterns match a URL.",
       "color": "#0055E5",
       "type": 5,
       "whitePatterns": [
         {
           "title": "all URLs",
           "active": true,
           "pattern": "*",
           "type": 1,
           "protocols": 1
         }
       ],
       "blackPatterns": [],
       "index": 9007199254740991
     },
     "logging": {
       "active": true,
       "maxSize": 500
     },
     "mode": "patterns",
     "browserVersion": "82.0.3",
     "foxyProxyVersion": "7.5.1",
     "foxyProxyEdition": "standard"
   }

6. On the Import Settings from FoxyProxy 6.0+ pane, choose Import Settings and select the mwaa-proxy.json file.

7. Choose OK.

1. Open the Environments page on the Amazon MWAA console.

2. Choose Open Airflow UI.