An Airflow UI that Is Not on the Public Internet
webserver_access_mode defaults to PUBLIC_ONLY, and the Airflow UI is not a dashboard: anyone who reaches it can trigger a DAG, which is arbitrary Python running as the execution role. PRIVATE_ONLY here, all five log streams on, and a precondition refuses an unpinned requirements.txt or plugins.zip - where bucket write access is otherwise the same permission as code execution.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "mwaa" {
source = "www.iac-bazaar.com/iac-bazaar/aws-mwaa/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/aws-mwaa?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [An Airflow UI that Is Not on the Public Internet](https://www.iac-bazaar.com/catalog/aws-mwaa?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "mwaa" {
source = "www.iac-bazaar.com/iac-bazaar/aws-mwaa/aws"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-mwaa
A Managed Workflows for Apache Airflow environment whose web UI is not on the
public internet, whose logs exist, and whose dependencies cannot be changed
from underneath it. Works with Terraform and OpenTofu (>= 1.6), AWS
provider >= 6.0, < 7.0.
webserver_access_mode defaults to PUBLIC_ONLY. The Airflow UI is not a
dashboard: anyone who reaches it can trigger a DAG, and a DAG is arbitrary
Python running as the environment's execution role. The endpoint does demand
IAM credentials, so the AWS default is not an open door - it is the entire
control surface of a data platform, published, one leaked console credential
away from code execution in your account. PRIVATE_ONLY here, and
webserver_on_public_internet is an output so a policy test can assert on it.
Every log stream is off by default. All five of them - DAG processing,
scheduler, task, webserver, worker. A DAG that fails leaves no record, and so
does a DAG that succeeded while doing something it should not have. All five on
here at INFO, written as five static blocks rather than a dynamic one so
configuration scanners can actually read them.
requirements.txt and plugins.zip are arbitrary code, and MWAA reads the
latest version unless you name one. requirements.txt installs packages onto
every scheduler and worker; plugins.zip is imported as Python into the
scheduler; the startup script runs before Airflow starts at all. Without an S3
object version, "who can write this bucket" is the same permission as "who
can run code in this environment" - and it takes effect on the next
environment update, not at apply time, so nothing in your plan shows it.
A precondition refuses any of the three paths without its version.
Smaller things: exactly two subnets in two AZs, checked before the
twenty-minute create fails on it; two schedulers minimum, because one is a
single point of failure for every DAG; and kms_key defaults to an AWS-owned
key that cannot be audited or revoked, so the module takes yours.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-codebuild
privileged_mode hands the build the Docker socket, so anything it runs can read every environment variable and assume the service role. Off by default, and a PLAINTEXT variable whose name looks like a secret is refused.
aws-fis
FIS refuses a template with no stop condition, which reads like a guarantee - and source = 'none' is a legal stop condition meaning the experiment never halts by itself. Refused here, along with targets that grow at run time and an empty-target mode that reports success for having tested nothing.
aws-codeartifact
A repository with a public external connection serves whatever the public registry holds for any name it does not. This puts the connection on its own repository, reached through an upstream, and emits the origin-control commands Terraform cannot apply.
aws-appconfig
AppConfig exists to deploy a configuration slowly and roll it back automatically, and both halves are opt-in - the predefined AllAtOnce strategy is 100% of the fleet with zero bake time. Gradual here, and a precondition refuses an environment with no alarms, where automatic rollback has nothing to fire on.
ansible-aws-cli-v2
The AWS CLI v2 from the upstream zip, verified with gpg against the AWS CLI Team key (pinned by fingerprint, in a GnuPG home of its own) before it is unpacked. EL 10 has no package; most installs run curl | unzip and never read the signature. Pinned version, tab completion, and a live test that runs an API call to 'Unable to locate credentials'. Original role, live-tested on Rocky Linux 10.
aws-codedeploy
CodeDeploy application, deployment groups, and the platform-correct service role for automated EC2/ECS/Lambda rollouts with auto-rollback on failure.