Role-based access control (RBAC) assigns permissions to roles, then assigns users to those roles. In Airflow, the web interface applies those permissions to menus, pages, DAGs, and security operations. section 16.1 section 16.1.1
Create a role-assigned Airflow user
Create Bob Smith with the Admin role using `airflow users create --role Admin --username bobsmith --password topsecret --email bobsmith@company.com --firstname Bob --lastname Smith`. Admin grants all permissions, so production deployments should grant it cautiously. section 16.1.1
Airflow’s default roles separate common operational responsibilities:
- Public provides no permissions and supports unauthenticated access. section 16.1.1
- Viewer provides read-only access to DAGs. section 16.1.1
- User permits DAG creation and DAG actions such as triggering, pausing, and clearing, while excluding secrets. section 16.1.1
- Op adds access to connections, pools, variables, XComs, and configuration. section 16.1.1
- Admin grants every permission, including access to security management. section 16.1.1
Permissions are fine-grained: exposing a menu and one of its items can require separate permissions. Inspecting existing roles can help identify the strings needed for a desired access pattern. section 16.1.1
Shared Airflow instances can reduce cost but complicate team ownership, DAG visibility, and overwrite prevention. Separate instances improve isolation and upgrade control, but duplicate components and increase management cost. section 15.9
Table 16.1 Airflow RBAC interface default role permissions
| Role name |
Intended users/use |
Default permissions |
| Admin |
Necessary only when managing security permissions |
All |
| Public |
Unauthenticated users |
None |
| Viewer |
Read-only view of Airflow |
Read access to directed acyclic graphs (DAGs) |
| User |
Grants permissions only to create DAGs, not secrets; useful if you want strict separation in your team between developers who can and can’t edit secrets (connections, variables, and so on) |
Same as Viewer but with edit permissions (clear, trigger, pause, and so on) on DAGs |
| Op |
All permissions required for developing Airflow DAGs |
Same as User but with additional permissions to view and edit connections, pools, variables, XComs, and configuration |
Compare Airflow’s default roles with their intended users and permission boundaries. section 16.1.1
