Symmetric-key encryption uses one secret key to encrypt and decrypt data. In Airflow, a Fernet key protects passwords, connections, and variables stored in the database, so database access alone does not reveal their plaintext values. section 16.2
Apply the technique with disciplined key management:
- Generate a Fernet key with Python's Fernet.generate_key(). section 16.2
- Provide the key through AIRFLOW__CORE__FERNET_KEY, or configure AIRFLOW__CORE__FERNET_KEY_CMD to read it from a protected file. section 16.2
- Protect the key itself: anyone who obtains it can decrypt secrets, while losing it makes encrypted values unrecoverable. section 16.2
- Recognize its role in HTTPS, where asymmetric encryption helps establish a session key and symmetric encryption protects the subsequent traffic. section 16.4.1
Create and configure an Airflow Fernet key
from cryptography.fernet import Fernet fernet_key = Fernet.generate_key() print(fernet_key.decode()) # Configure the resulting value: AIRFLOW__CORE__FERNET_KEY=<generated-key> For stronger handling, store the key in a read-only file and set AIRFLOW__CORE__FERNET_KEY_CMD to read that file. section 16.2
Figure 16.7 A Fernet key encrypts data before storing it in the database and decrypts data before reading it from the database. Without access to the Fernet key, passwords are useless to an intruder.
Trace how Airflow encrypts secrets before database storage and decrypts them when reading them. section 16.2
