View a markdown version of this page

Managing teams - Amazon Managed Workflows for Apache Airflow
Adding teams (console)Adding and updating teams (AWS CLI)Removing teams

Managing teams

You can add, update, and remove teams by using the Amazon MWAA console or the AWS CLI. Before you start, review the prerequisites and the team name and DAG folder rules in Multi-team environments.

Important

Amazon MWAA multi-team support is based on the Apache Airflow multi-team feature. This Apache Airflow feature is experimental and in preview as of Apache Airflow version 3.3.1. The feature is not complete, and its behavior and APIs can change in breaking ways, or be removed, between releases without notice. We recommend that you use multi-team environments with caution and that you don't rely on them for production-critical workloads. For more information, see Experimental features on the Apache Airflow website.

Adding teams (console)

You can add teams when you create an environment or when you edit an existing environment.

Adding teams to a new environment

To add teams when you create an environment

  1. Open the Environments page on the Amazon MWAA console.

  2. Choose Create environment.

  3. On the Specify details page, configure the environment name and the DAG code settings. The DAG folder that you specify becomes the global DAG folder.

  4. On the Configure advanced settings page, expand Identity Center configuration.

  5. Turn on Enable IAM Identity Center integration, and then enter the AWS access portal URL and Identity Store ID.

    You can't disable IAM Identity Center integration after you enable it.

  6. Expand Teams.

  7. Choose Add new team.

  8. For Team name, enter the display name of the team's IAM Identity Center group.

  9. For DAGs folder, keep the default location or enter a different Amazon S3 URI. You can also choose Browse S3. The default location is a folder named after the team in the bucket that you chose on the Specify details page, such as s3://amzn-s3-demo-bucket/data-engineering/.

  10. To add more teams, repeat the previous three steps.

  11. Finish configuring the environment, and then choose Create environment.

Adding teams to an existing environment

To add teams to an existing environment

  1. Open the Environments page on the Amazon MWAA console.

  2. Choose the environment, and then choose Edit.

  3. Choose Next to go to the Configure advanced settings page.

  4. Under Identity Center configuration, make sure that Enable IAM Identity Center integration is turned on, and then expand Teams.

    If the environment doesn't use IAM Identity Center yet, enabling it is permanent. Before you enable it, see Alternative: enable IAM Identity Center on an existing environment.

  5. Choose Add new team, and then enter the team name and DAG folder as described in the previous procedure.

  6. Choose Next until you are on the Review and save page, review your changes, and then choose Save.

Adding and updating teams (AWS CLI)

Use the --teams parameter of the create-environment and update-environment commands. The parameter has a different format for each command:

  • create-environment takes a map of teams. Each key is a team name, and each value specifies the team's Amazon S3 bucket ARN (SourceBucketArn) and DAG folder path (DagS3Path). Each team can use a different bucket, as long as the environment's execution role can read from it.

  • update-environment takes an object with two optional fields. AddOrUpdate is a map of teams in the same format as create-environment. Remove is a list of team names to remove.

Adding teams to a new environment

Example Create an environment with two teams
aws mwaa create-environment \
  --name my-multi-team-environment \
  --airflow-version 3.3.1 \
  --source-bucket-arn arn:aws:s3:::amzn-s3-demo-bucket \
  --dag-s3-path dags \
  --execution-role-arn arn:aws:iam::123456789012:role/MyMWAAExecutionRole \
  --network-configuration SubnetIds=subnet-12345,subnet-67890,SecurityGroupIds=sg-12345 \
  --identity-center-configuration StartUrl=https://my-org.awsapps.com/start,IdentityStoreId=d-1234567890 \
  --teams '{
    "data-engineering": {
      "SourceBucketArn": "arn:aws:s3:::amzn-s3-demo-bucket",
      "DagS3Path": "teams/data-engineering/"
    },
    "analytics": {
      "SourceBucketArn": "arn:aws:s3:::amzn-s3-demo-bucket",
      "DagS3Path": "teams/analytics/"
    }
  }'

Adding or updating teams in an existing environment

Example Add a team to an existing environment
aws mwaa update-environment \
  --name my-multi-team-environment \
  --teams '{
    "AddOrUpdate": {
      "ml-ops": {
        "SourceBucketArn": "arn:aws:s3:::amzn-s3-demo-bucket",
        "DagS3Path": "teams/ml-ops/"
      }
    }
  }'

Removing teams

When you save the change, Amazon MWAA stops processing the team's DAGs. Existing DAG runs remain in the metadata database, but the team's DAGs, variables, and connections become inaccessible. You can't undo this action. Amazon MWAA doesn't delete the team's DAG files in Amazon S3.

You can't rename a team. To change a team's name, remove the team and add a new one. You can't remove a team and add a team with the same name in the same update.

Removing teams (console)

To remove a team

  1. Open the Environments page on the Amazon MWAA console.

  2. Choose the environment, and then choose Edit.

  3. Choose Next to go to the Configure advanced settings page, and then expand Teams.

  4. Choose the remove icon (✕) next to the team that you want to remove.

  5. In the Remove team? dialog box, enter the team name to confirm, and then choose Remove team.

  6. Choose Next until you are on the Review and save page, review your changes, and then choose Save.

Removing teams (AWS CLI)

Use the Remove field of the --teams parameter.

Example Remove two teams
aws mwaa update-environment \
  --name my-multi-team-environment \
  --teams '{
    "Remove": ["ml-ops", "analytics"]
  }'

Returning to single-team mode

When you remove all teams, the environment returns to single-team mode. Users still sign in through IAM Identity Center, and all users see the DAGs in the environment's DAG folder. IAM Identity Center integration stays enabled, because you can't disable it.