Security protects an Airflow installation and the systems it can access against unauthorized access, misuse, alteration, or disruption. Because Airflow orchestrates many other systems, it is a desirable target and requires layered controls rather than one isolated defense. section 16.0
Configure security across the Airflow deployment:
- Use role-based access control to restrict which actions user groups can perform. section 16.6
- Connect RBAC to an existing LDAP service to centralize user management. section 16.6
- Apply TLS encryption, also known as HTTPS, to protect traffic between clients and the Airflow web server. section 16.6
- Encrypt database secrets with a Fernet key so intercepted credentials remain unreadable. section 16.6
- Store and manage secrets in a system such as HashiCorp Vault, sharing them with Airflow only when necessary. section 16.6
Restrict dependencies with containers
A workflow can place open-source analytics or logging dependencies in one container while keeping critical workflows limited to secure, approved libraries. Separating dependencies this way improves safety and allows each image to be tested independently from the DAG. section 11.3.2
Figure 11.6 Managing dependencies across different tasks using containers
Use the dependency diagram to see how containers isolate requirements across different tasks. section 11.3.2
