Secrets management in Apache Airflow - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is secrets management in Airflow?

Secrets management in Airflow is the practice of securely storing and accessing sensitive information like passwords, API keys, and tokens needed by workflows.

beginner

Name one built-in backend Airflow supports for secrets management.

Airflow supports several backends like HashiCorp Vault, AWS Secrets Manager, Google Secret Manager, and environment variables for secrets management.

intermediate

How do you configure Airflow to use HashiCorp Vault for secrets?

You set the 'secrets_backend' option in airflow.cfg to 'airflow.providers.hashicorp.secrets.vault.VaultBackend' and provide Vault connection details in the configuration.

beginner

Why should you avoid hardcoding secrets in Airflow DAG files?

Hardcoding secrets risks exposing sensitive data in code repositories and logs, increasing the chance of leaks and security breaches.

beginner

What is the benefit of using environment variables for secrets in Airflow?

Environment variables allow you to keep secrets outside the code and configuration files, making it easier to manage and rotate secrets securely.

Which Airflow configuration option sets the secrets backend?

A secret_manager

B secrets_backend

C backend_secret

D secret_storage

The 'secrets_backend' option in airflow.cfg specifies which secrets backend Airflow uses.

Which of these is NOT a supported secrets backend in Airflow?

A Azure Blob Storage

B HashiCorp Vault

C Google Secret Manager

D AWS Secrets Manager

Azure Blob Storage is for file storage, not a secrets backend supported by Airflow.

Why is it important to use secrets management in Airflow?

A To increase log verbosity

B To speed up DAG execution

C To store sensitive data securely

D To reduce CPU usage

Secrets management helps keep sensitive data like passwords safe and out of code.

What is a risk of hardcoding secrets in Airflow DAG files?

A Secrets will auto-rotate

B DAGs will run slower

C Airflow will crash

D Secrets may be exposed in code repositories

Hardcoded secrets can be accidentally shared when code is pushed to repositories.

How can environment variables help with secrets in Airflow?

A They keep secrets outside code and config files

B They encrypt secrets automatically

C They speed up DAG scheduling

D They disable logging

Environment variables allow secrets to be managed separately from code, improving security.

Explain how Airflow can securely access secrets using a secrets backend.

Think about how Airflow connects to external secret stores instead of storing secrets in code.

Describe best practices for managing secrets in Airflow workflows.

Consider security and ease of secret updates.