<p>So, we can see from this fun issue: <a href="https://github.com/aws/aws-cli/issues/4947" rel="noreferrer">https://github.com/aws/aws-cli/issues/4947</a></p>
<p>that AWS CLI 2 is never going to be pushed to pip.</p>
<p>In AWS MWAA (Managed AIrflow), we <em>are not given</em> the ability to specify apt-get level installs. We get a <code>requirements.txt</code>, only, and AWS V2 is not available via that. Meaning, we have no interface or medium to do what the Amazon representative in that issue talks about, which is to use the package manager (from Amazon's MWAA).</p>
<p>Recently, we have hit issues with authenticating to our kubernetes clusters, because the AWS CLI in various versions <em>hardcodes</em> the auth version: <a href="https://github.com/aws/aws-cli/blob/1.20.11/awscli/customizations/eks/get_token.py#L77" rel="noreferrer">https://github.com/aws/aws-cli/blob/1.20.11/awscli/customizations/eks/get_token.py#L77</a></p>
<p>In other versions, it's hardcoded to <code>alpha</code> etc. Which means depending on what aws cli version a worker comes up with, it may or may not match what your kubeconfig in S3 for MWAA has. We've been hitting transient mismatches like</p>
<pre><code>{{refresh_config.py:71}} ERROR - exec: plugin api version client.authentication.k8s.io/v1alpha1 does not match client.authentication.k8s.io/v1beta1
</code></pre>
<p>and, if we &quot;flip&quot; our kubeconfig,</p>
<pre><code>{{refresh_config.py:71}} ERROR - exec: plugin api version client.authentication.k8s.io/v1beta1 does not match client.authentication.k8s.io/v1alpha1
</code></pre>
<p>Since we use the kubernetes executor from Airflow, we need <code>get-token</code>:</p>
<pre><code>  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1beta1
      args:
      - --region
      - us-east-1
      - eks
      - get-token
      - --cluster-name
      - thor
      command: aws
</code></pre>
<p>but this get-token returns a different version of the auth sometimes as discussed.</p>
<p>Currently, we have pinned <code>awscli</code> hard in <code>requirements.txt</code> to <code>1.20.11</code>. However, AWS Says to <em>stop</em> using V1: <a href="https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2-mac.html" rel="noreferrer">https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2-mac.html</a></p>
<p>So, with all of this said, how can I install a specific version of AWS CLI 2 on my AWS MWAA workers? Help from Amazon would be appreciated; I will file an AWS Support ticket there too.</p>

Tommy
<p>MWAA doesn't currently support installing a specific AWS CLI version.  This is a limitation that the MWAA team is aware of.</p>
