apache-airflow-providers-amazon 9.5.0rc3__tar.gz → 9.6.0__tar.gz

{apache_airflow_providers_amazon-9.5.0rc3 → apache_airflow_providers_amazon-9.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apache-airflow-providers-amazon
-Version: 9.5.0rc3
+Version: 9.6.0
 Summary: Provider package apache-airflow-providers-amazon for Apache Airflow
 Keywords: airflow-provider,amazon,airflow,integration
 Author-email: Apache Software Foundation <dev@airflow.apache.org>
@@ -20,23 +20,23 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: System :: Monitoring
-Requires-Dist: apache-airflow>=2.9.0rc0
-Requires-Dist: apache-airflow-providers-common-compat>=1.6.0rc0
-Requires-Dist: apache-airflow-providers-common-sql>=1.20.0rc0
+Requires-Dist: apache-airflow>=2.9.0
+Requires-Dist: apache-airflow-providers-common-compat>=1.6.0
+Requires-Dist: apache-airflow-providers-common-sql>=1.20.0
 Requires-Dist: apache-airflow-providers-http
 Requires-Dist: boto3>=1.37.0
-Requires-Dist: botocore>=1.34.90
+Requires-Dist: botocore>=1.37.0
 Requires-Dist: inflection>=0.5.1
-Requires-Dist: watchtower>=3.0.0,!=3.3.0,<4
+Requires-Dist: watchtower>=3.3.1,<4
 Requires-Dist: jsonpath_ng>=1.5.3
-Requires-Dist: redshift_connector>=2.0.918
+Requires-Dist: redshift_connector>=2.1.3
 Requires-Dist: asgiref>=2.3.0
-Requires-Dist: PyAthena>=3.0.10
+Requires-Dist: PyAthena>=3.10.0
 Requires-Dist: jmespath>=0.7.0
 Requires-Dist: python3-saml>=1.16.0
 Requires-Dist: xmlsec!=1.3.15,>=1.3.14
 Requires-Dist: sagemaker-studio>=1.0.9
-Requires-Dist: aiobotocore[boto3]>=2.13.0 ; extra == "aiobotocore"
+Requires-Dist: aiobotocore[boto3]>=2.20.0 ; extra == "aiobotocore"
 Requires-Dist: apache-airflow-providers-apache-hive ; extra == "apache-hive"
 Requires-Dist: apache-airflow-providers-cncf-kubernetes>=7.2.0 ; extra == "cncf-kubernetes"
 Requires-Dist: apache-airflow-providers-exasol ; extra == "exasol"
@@ -54,8 +54,8 @@ Requires-Dist: apache-airflow-providers-salesforce ; extra == "salesforce"
 Requires-Dist: apache-airflow-providers-ssh ; extra == "ssh"
 Requires-Dist: apache-airflow-providers-standard ; extra == "standard"
 Project-URL: Bug Tracker, https://github.com/apache/airflow/issues
-Project-URL: Changelog, https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.5.0/changelog.html
-Project-URL: Documentation, https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.5.0
+Project-URL: Changelog, https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.6.0/changelog.html
+Project-URL: Documentation, https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.6.0
 Project-URL: Mastodon, https://fosstodon.org/@airflow
 Project-URL: Slack Chat, https://s.apache.org/airflow-slack
 Project-URL: Source Code, https://github.com/apache/airflow
@@ -103,7 +103,7 @@ Provides-Extra: standard
 
 Package ``apache-airflow-providers-amazon``
 
-Release: ``9.5.0``
+Release: ``9.6.0``
 
 
 Amazon integration (including `Amazon Web Services (AWS) <https://aws.amazon.com/>`__).
@@ -116,7 +116,7 @@ This is a provider package for ``amazon`` provider. All classes for this provide
 are in ``airflow.providers.amazon`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.5.0/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.6.0/>`_.
 
 Installation
 ------------
@@ -130,26 +130,26 @@ The package supports the following python versions: 3.9,3.10,3.11,3.12
 Requirements
 ------------
 
-==========================================  ======================
+==========================================  =====================
 PIP package                                 Version required
-==========================================  ======================
+==========================================  =====================
 ``apache-airflow``                          ``>=2.9.0``
 ``apache-airflow-providers-common-compat``  ``>=1.6.0``
 ``apache-airflow-providers-common-sql``     ``>=1.20.0``
 ``apache-airflow-providers-http``
 ``boto3``                                   ``>=1.37.0``
-``botocore``                                ``>=1.34.90``
+``botocore``                                ``>=1.37.0``
 ``inflection``                              ``>=0.5.1``
-``watchtower``                              ``>=3.0.0,!=3.3.0,<4``
+``watchtower``                              ``>=3.3.1,<4``
 ``jsonpath_ng``                             ``>=1.5.3``
-``redshift_connector``                      ``>=2.0.918``
+``redshift_connector``                      ``>=2.1.3``
 ``asgiref``                                 ``>=2.3.0``
-``PyAthena``                                ``>=3.0.10``
+``PyAthena``                                ``>=3.10.0``
 ``jmespath``                                ``>=0.7.0``
 ``python3-saml``                            ``>=1.16.0``
 ``xmlsec``                                  ``>=1.3.14,!=1.3.15``
 ``sagemaker-studio``                        ``>=1.0.9``
-==========================================  ======================
+==========================================  =====================
 
 Cross provider package dependencies
 -----------------------------------
@@ -184,5 +184,5 @@ Dependent package
 ======================================================================================================================  ===================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.5.0/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.6.0/changelog.html>`_.
 

{apache_airflow_providers_amazon-9.5.0rc3 → apache_airflow_providers_amazon-9.6.0}/README.rst

@@ -23,7 +23,7 @@
 
 Package ``apache-airflow-providers-amazon``
 
-Release: ``9.5.0``
+Release: ``9.6.0``
 
 
 Amazon integration (including `Amazon Web Services (AWS) <https://aws.amazon.com/>`__).
@@ -36,7 +36,7 @@ This is a provider package for ``amazon`` provider. All classes for this provide
 are in ``airflow.providers.amazon`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.5.0/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.6.0/>`_.
 
 Installation
 ------------
@@ -50,26 +50,26 @@ The package supports the following python versions: 3.9,3.10,3.11,3.12
 Requirements
 ------------
 
-==========================================  ======================
+==========================================  =====================
 PIP package                                 Version required
-==========================================  ======================
+==========================================  =====================
 ``apache-airflow``                          ``>=2.9.0``
 ``apache-airflow-providers-common-compat``  ``>=1.6.0``
 ``apache-airflow-providers-common-sql``     ``>=1.20.0``
 ``apache-airflow-providers-http``
 ``boto3``                                   ``>=1.37.0``
-``botocore``                                ``>=1.34.90``
+``botocore``                                ``>=1.37.0``
 ``inflection``                              ``>=0.5.1``
-``watchtower``                              ``>=3.0.0,!=3.3.0,<4``
+``watchtower``                              ``>=3.3.1,<4``
 ``jsonpath_ng``                             ``>=1.5.3``
-``redshift_connector``                      ``>=2.0.918``
+``redshift_connector``                      ``>=2.1.3``
 ``asgiref``                                 ``>=2.3.0``
-``PyAthena``                                ``>=3.0.10``
+``PyAthena``                                ``>=3.10.0``
 ``jmespath``                                ``>=0.7.0``
 ``python3-saml``                            ``>=1.16.0``
 ``xmlsec``                                  ``>=1.3.14,!=1.3.15``
 ``sagemaker-studio``                        ``>=1.0.9``
-==========================================  ======================
+==========================================  =====================
 
 Cross provider package dependencies
 -----------------------------------
@@ -104,4 +104,4 @@ Dependent package
 ======================================================================================================================  ===================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.5.0/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-amazon/9.6.0/changelog.html>`_.

apache_airflow_providers_amazon-9.6.0/docs/.latest-doc-only-change.txt

@@ -0,0 +1 @@
+9e1ac6e425aa52a55601bb2b5587fd97d361bfcc

apache_airflow_providers_amazon-9.6.0/docs/_partials/generic_parameters.rst

@@ -0,0 +1,68 @@
+ .. Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+ ..   http://www.apache.org/licenses/LICENSE-2.0
+
+ .. Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+
+aws_conn_id
+    Reference to :ref:`Amazon Web Services Connection <howto/connection:aws>` ID.
+    If this parameter is set to ``None`` then the default boto3 behaviour is used without a connection lookup.
+    Otherwise use the credentials stored in the Connection. Default: ``aws_default``
+
+region_name
+    AWS Region Name. If this parameter is set to ``None`` or omitted then **region_name** from
+    :ref:`AWS Connection Extra Parameter <howto/connection:aws:configuring-the-connection>` will be used.
+    Otherwise use the specified value instead of the connection value. Default: ``None``
+
+verify
+    Whether or not to verify SSL certificates.
+
+    * ``False`` - Do not validate SSL certificates.
+    * **path/to/cert/bundle.pem** - A filename of the CA cert bundle to use. You can specify this argument
+      if you want to use a different CA cert bundle than the one used by botocore.
+
+    If this parameter is set to ``None`` or is omitted then **verify** from
+    :ref:`AWS Connection Extra Parameter <howto/connection:aws:configuring-the-connection>` will be used.
+    Otherwise use the specified value instead of the connection value. Default: ``None``
+
+botocore_config
+    The provided dictionary is used to construct a `botocore.config.Config`_.
+    This configuration can be used to configure :ref:`howto/connection:aws:avoid-throttling-exceptions`, timeouts, etc.
+
+    ..  code-block:: python
+        :caption: Example, for more detail about parameters please have a look `botocore.config.Config`_
+
+        {
+            "signature_version": "unsigned",
+            "s3": {
+                "us_east_1_regional_endpoint": True,
+            },
+            "retries": {
+              "mode": "standard",
+              "max_attempts": 10,
+            },
+            "connect_timeout": 300,
+            "read_timeout": 300,
+            "tcp_keepalive": True,
+        }
+
+    If this parameter is set to ``None`` or omitted then **config_kwargs** from
+    :ref:`AWS Connection Extra Parameter <howto/connection:aws:configuring-the-connection>` will be used.
+    Otherwise use the specified value instead of the connection value. Default: ``None``
+
+    .. note::
+        Specifying an empty dictionary, ``{}``, will overwrite the connection configuration for `botocore.config.Config`_
+
+.. _botocore.config.Config: https://botocore.amazonaws.com/v1/documentation/api/latest/reference/config.html

apache_airflow_providers_amazon-9.6.0/docs/_partials/prerequisite_tasks.rst

@@ -0,0 +1,34 @@
+ .. Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+ ..   http://www.apache.org/licenses/LICENSE-2.0
+
+ .. Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+
+
+To use these operators, you must do a few things:
+
+  * Create necessary resources using `AWS Console`_ or `AWS CLI`_.
+  * Install API libraries via **pip**.
+
+    .. code-block:: bash
+
+      pip install 'apache-airflow[amazon]'
+
+    Detailed information is available :doc:`apache-airflow:installation/index`
+
+  * :doc:`Setup Connection </connections/aws>`.
+
+.. _AWS Console: https://console.aws.amazon.com
+.. _AWS CLI: https://aws.amazon.com/cli

apache_airflow_providers_amazon-9.6.0/docs/auth-manager/index.rst

@@ -0,0 +1,47 @@
+ .. Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+ ..   http://www.apache.org/licenses/LICENSE-2.0
+
+ .. Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+================
+AWS auth manager
+================
+
+.. warning::
+  The AWS auth manager is alpha/experimental at the moment and may be subject to change without warning.
+
+The AWS auth manager is an auth manager powered by AWS. It uses two services:
+
+* `AWS IAM Identity Center <https://aws.amazon.com/iam/identity-center/>`_ for authentication purposes
+* `Amazon Verified Permissions <https://aws.amazon.com/verified-permissions/>`_ for authorization purposes
+
+.. image:: ../img/diagram_auth_manager_architecture.png
+
+
+**Getting started**
+
+.. toctree::
+    :maxdepth: 2
+
+    setup/config
+    setup/identity-center
+    setup/amazon-verified-permissions
+
+**Manage the environment**
+
+.. toctree::
+    :maxdepth: 2
+
+    manage/index

apache_airflow_providers_amazon-9.6.0/docs/auth-manager/manage/index.rst

@@ -0,0 +1,289 @@
+ .. Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+ ..   http://www.apache.org/licenses/LICENSE-2.0
+
+ .. Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+================================================
+Manage Airflow environment with AWS auth manager
+================================================
+
+When the AWS auth manager is used, all users and their permissions are no longer managed by the Flask auth manager,
+which is default in Airflow, but by AWS-based authorization integration through two different services:
+AWS IAM Identity Center (users) and Amazon Verified Permissions (permissions).
+
+Manage users through AWS IAM Identity Center
+============================================
+
+Users
+-----
+
+All users having access to the Airflow environment must be defined in AWS IAM Identity Center.
+You can use AWS IAM Identity center as identity source or as a proxy between the identity source
+(e.g. Active Directory) and the Airflow environment.
+`See documentation for more details on how to manage your identity source <https://docs.aws.amazon.com/singlesignon/latest/userguide/identities.html>`__.
+
+You can see the list of users defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Users**.
+
+Groups
+------
+
+You can use groups in AWS IAM Identity center to group users in logical entities (e.g. by team, by department, ...).
+Later, these groups can be used in Amazon Verified Permissions to assign permissions to a group of users.
+`See documentation to add users to groups <https://docs.aws.amazon.com/singlesignon/latest/userguide/adduserstogroups.html>`__.
+
+You can see the list of groups defined in AWS IAM Identity Center by following these steps.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+2. Choose **Groups**.
+
+Assign users and groups to the Airflow environment
+--------------------------------------------------
+
+.. note::
+  All users and groups defined in AWS IAM Identity Center do not have automatic access to the Airflow environment.
+  You need to manually assign which user can access to Airflow.
+
+To assign users and groups to Airflow, please follow the steps below.
+
+1. Open the `IAM Identity Center console <https://console.aws.amazon.com/singlesignon>`_.
+
+.. note::
+  If you manage users in AWS Managed Microsoft AD, make sure that the IAM Identity Center console is using the AWS
+  Region where your AWS Managed Microsoft AD directory is located before taking the next step.
+
+2. Choose **Applications**.
+3. Choose the **Customer managed** tab.
+4. In the list of applications, choose the application name ``Airflow``.
+5. On the application details page, in the **Assigned users and groups** section, choose **Assign users and groups**.
+6. In the **Assign users or groups** page, select the different users and groups you want to assign to Airflow.
+   You can also search users and groups.
+   You can specify multiple users or groups by selecting the applicable accounts as they appear in search results.
+7. Choose **Assign users**.
+
+Manage user permissions through Amazon Verified Permissions
+===========================================================
+
+AWS auth manager uses Amazon Verified Permissions to define and verify user permissions.
+It uses `Cedar language <https://www.cedarpolicy.com/>`__ to define fine-grained permissions for users.
+AWS auth manager uses one policy store to store all policies related to the Airflow environment.
+To manage these policies, please follow the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Policies**.
+4. On the **Policies** page, you can see the list of policies. To create a new policy, please follow steps below.
+
+  a. Choose **Create policy**.
+  b. Under **Create policy**, choose **Create static policy**.
+
+Policy format
+-------------
+
+Policies are defined using Cedar language in Amazon Verified Permissions.
+For a complete documentation, `see cedar language website <https://www.cedarpolicy.com/>`__.
+In cedar language, a policy is composed of three elements:
+
+* **Principal**. Who is making the request?
+* **Action**. What operation does the principal want to perform?
+* **Resource**. What does the principal want to perform the action on?
+
+Each of these three elements allow only a specific set of values in the context of the Airflow environment.
+You can see the list of principals, actions and resources in the policy store schema by following the steps below.
+
+1. Open the `Amazon Verified Permissions console <https://console.aws.amazon.com/verifiedpermissions>`_.
+2. Choose the policy store used by Airflow (by default its description is ``Airflow``).
+3. In the navigation pane on the left, choose **Schema**.
+
+Example of policies
+-------------------
+
+Here are some example of policies you can define in Amazon Verified Permissions.
+You can modify and/or combine them to create your owned tailor made policies.
+
+Give all permissions to specific user
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+ ::
+
+  permit(
+    principal == Airflow::User::"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+    action,
+    resource
+  );
+
+.. note::
+  You must reference the user by its user ID and not its username or any other attribute.
+  You can find the user ID in AWS IAM Identity Center.
+
+
+Give all permissions to a group of users
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is equivalent to the :doc:`Admin role in Flask AppBuilder <apache-airflow-providers-fab:auth-manager/access-control>`.
+
+ ::
+
+  permit(
+    principal in Airflow::Group::"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+    action,
+    resource
+  );
+
+.. note::
+  You must reference the group by its group ID and not its name. You can find the group ID in AWS IAM Identity Center.
+
+Give read-only permissions to a group of users
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is equivalent to the :doc:`Viewer role in Flask AppBuilder <apache-airflow-providers-fab:auth-manager/access-control>`.
+
+ ::
+
+  permit(
+    principal in Airflow::Group::"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+    action in [
+      Airflow::Action::"Configuration.GET",
+      Airflow::Action::"Connection.GET",
+      Airflow::Action::"Custom.GET",
+      Airflow::Action::"Dag.GET",
+      Airflow::Action::"Menu.MENU",
+      Airflow::Action::"Pool.GET",
+      Airflow::Action::"Variable.GET",
+      Airflow::Action::"Asset.GET",
+      Airflow::Action::"View.GET"
+    ],
+    resource
+  );
+
+Give standard Airflow user permissions to a group of users
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is equivalent to the :doc:`User role in Flask AppBuilder <apache-airflow-providers-fab:auth-manager/access-control>`.
+
+ ::
+
+  permit(
+    principal in Airflow::Group::"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+    action in [
+      Airflow::Action::"Configuration.GET",
+      Airflow::Action::"Connection.GET",
+      Airflow::Action::"Custom.GET",
+      Airflow::Action::"Dag.GET",
+      Airflow::Action::"Menu.MENU",
+      Airflow::Action::"Pool.GET",
+      Airflow::Action::"Variable.GET",
+      Airflow::Action::"Asset.GET",
+      Airflow::Action::"View.GET",
+      Airflow::Action::"Dag.POST",
+      Airflow::Action::"Dag.PUT",
+      Airflow::Action::"Dag.DELETE",
+    ],
+    resource
+  );
+
+Give operational permissions to a group of users
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is equivalent to the :doc:`Op role in Flask AppBuilder <apache-airflow-providers-fab:auth-manager/access-control>`.
+
+ ::
+
+  permit(
+    principal in Airflow::Group::"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+    action in [
+      Airflow::Action::"Configuration.GET",
+      Airflow::Action::"Connection.GET",
+      Airflow::Action::"Custom.GET",
+      Airflow::Action::"Dag.GET",
+      Airflow::Action::"Menu.MENU",
+      Airflow::Action::"Pool.GET",
+      Airflow::Action::"Variable.GET",
+      Airflow::Action::"Asset.GET",
+      Airflow::Action::"View.GET",
+      Airflow::Action::"Dag.POST",
+      Airflow::Action::"Dag.PUT",
+      Airflow::Action::"Dag.DELETE",
+      Airflow::Action::"Connection.POST",
+      Airflow::Action::"Connection.PUT",
+      Airflow::Action::"Connection.DELETE",
+      Airflow::Action::"Pool.POST",
+      Airflow::Action::"Pool.PUT",
+      Airflow::Action::"Pool.DELETE",
+      Airflow::Action::"Variable.POST",
+      Airflow::Action::"Variable.PUT",
+      Airflow::Action::"Variable.DELETE",
+      Airflow::Action::"Asset.POST",
+      Airflow::Action::"Asset.PUT",
+      Airflow::Action::"Asset.DELETE",
+
+    ],
+    resource
+  );
+
+Give DAG specific permissions to a group of users
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The policy below gives all DAG related permissions of the DAG ``test`` to a group of users.
+
+ ::
+
+  permit(
+    principal in Airflow::Group::"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+    action,
+    resource == Airflow::Dag::"test"
+  );
+
+The policy below gives all DAG related permissions of the DAGs ``financial-1`` and ``financial-2`` to a group of users.
+
+ ::
+
+  permit(
+    principal in Airflow::Group::"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+    action,
+    resource in [Airflow::Dag::"financial-1", Airflow::Dag::"financial-2"]
+  );
+
+The policy below gives access to logs of the DAG ``test`` to a group of users.
+
+ ::
+
+  permit(
+    principal in Airflow::Group::"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+    action,
+    resource == Airflow::Dag::"test"
+  ) when {
+    context has dag_entity && context.dag_entity == "TASK_LOGS"
+  };
+
+Forbid specific action to specific user
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+All policies defined in Amazon Verified Permissions are taken into account when doing an authorization check.
+For example, if both one **permit** and one **forbid** policies match the request, the access will be denied to the user.
+This can be useful if, for example, you want to restrict access to a specific user who belongs to a group that is
+granted all permissions.
+
+The policy below removes access of DAGs ``secret-dag-1`` and ``secret-dag-2`` from a specific user.
+
+ ::
+
+  forbid(
+    principal == Airflow::User::"aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+    action,
+    resource in [Airflow::Dag::"secret-dag-1", Airflow::Dag::"secret-dag-2"]
+  );