In production, Airflow is often used by multiple teams — data engineers, analysts, DevOps, and more. To ensure safety and compliance, you need to configure security, authentication, and role-based access control (RBAC).

In this lesson, you’ll learn how to secure Airflow, create user roles, and manage permissions effectively.

Learning Objectives

By the end of this lesson, you will be able to:

  • Explain how Airflow handles authentication and authorization.

  • Configure RBAC (Role-Based Access Control).

  • Assign roles and permissions to users.

  • Apply security best practices for production deployments.

1. Authentication in Airflow

  • Authentication verifies who the user is.

  • Options depend on your deployment:

    • Basic Authentication: Username & password.

    • OAuth: Integrate with Google, GitHub, Azure AD, Okta.

    • LDAP: Enterprise directory integration.

    • Kerberos: For secure environments (common in Hadoop/Spark clusters).

💡 In managed services (AWS MWAA, GCP Composer), authentication is handled via the provider’s IAM.

2. Role-Based Access Control (RBAC)

  • RBAC defines what a user can do.

  • Airflow’s RBAC UI is enabled by default in recent versions.

  • You can manage users and roles via the Security tab in the Web UI.

Common roles:

  • Admin: Full access, manage everything.

  • User: Can trigger and monitor DAGs.

  • Viewer: Read-only access.

  • Op (Operator): Limited permissions for running tasks.

👉 You can also create custom roles with specific permissions.

3. Assigning Roles to Users

  1. Go to Web UI → Security → List Users.

  2. Add or edit a user.

  3. Assign one or multiple roles.

Example:

  • Data Engineer: User role (can trigger and manage DAGs).

  • Analyst: Viewer role (can only see DAGs and logs).

  • Admin: Admin role (full control).

4. Permissions in Airflow

Permissions control which resources a user can access:

  • DAG-level permissions (view, edit, trigger, delete).

  • Access to certain menus in the Web UI.

  • Ability to manage connections and variables.

💡 Fine-grained DAG permissions can be enabled with access_control in the DAG definition:

with DAG(
    dag_id="secure_etl_pipeline",
    access_control={
        "Admins": {"can_read", "can_edit"},
        "Viewers": {"can_read"}
    },
    ...
) as dag:
    ...

5. Security Best Practices

  • Always enable RBAC UI (rbac = True in config for older versions).

  • Use strong authentication (OAuth, SSO, LDAP).

  • Apply the principle of least privilege (only give users what they need).

  • Secure connections & variables — never hardcode credentials in DAGs.

  • Use secrets managers (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager) for sensitive data.

  • Enable HTTPS for the Airflow Web UI in production.

Lesson Summary

  • Authentication verifies who a user is, authorization controls what they can do.

  • Airflow supports RBAC with predefined and custom roles.

  • Permissions can be applied globally or at the DAG level.

  • Security best practices include SSO, least privilege, secrets management, and HTTPS.

PreviousNext