An attack surface is the collection of possible points through which an attacker could attempt unauthorized access. In Airflow, every component that serves a request can become an entrance point, so reducing exposed components limits opportunities for intrusion. section 16.2
Narrow an Airflow attack surface by:
- Avoiding public exposure of services such as the Airflow UI; omit external IP addresses where possible, block traffic, and allowlist trusted IP ranges. section 16.2
- Encrypting database secrets with a Fernet key so passwords, connections, and variables are unreadable without the key. section 16.2
- Centralizing credentials in a secrets-management system instead of distributing copies across systems, reducing the number of places that can be breached. section 16.5
- Keeping Airflow releases current because updates may contain security fixes or close bugs in older versions. section 16.5
Protecting an Airflow deployment
A deployment can keep the UI private, restrict traffic to an allowlisted IP range, generate a Fernet key with cryptography.fernet.Fernet.generate_key(), and configure AIRFLOW__CORE__FERNET_KEY. A configured secrets backend can then supply a connection such as secure_api to an HttpOperator without broadly distributing its credential. section 16.2 section 16.5
Figure 16.6 The UI and database expose a service and could offer uninvited guests access to Airflow. Protecting these entrance points reduces the attack surface.
Use the architecture figure to identify the UI and database as exposed entrance points whose protection narrows the attack surface. section 16.2
