Secrets management in Apache Airflow - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to retrieve a secret value using Airflow's Variable API.

Apache Airflow

from airflow.models import Variable

api_key = Variable.get([1])

Drag options to blanks, or click blank then click option'

A'API_KEY'

BAPI_KEY

C"api_key"

Dapi_key

Attempts:

3 left

💡 Hint

Common Mistakes

Forgetting to put quotes around the secret name

Using variable names without quotes

You must pass the secret name as a string to Variable.get(). Using quotes ensures it is treated as a string key.

2fill in blank

medium

Complete the code to set a default value when retrieving a secret that might not exist.

Apache Airflow

from airflow.models import Variable

password = Variable.get('DB_PASSWORD', [1]='default_pass')

Drag options to blanks, or click blank then click option'

Adefault

Bdefault_var=True

Cdefault_var='default_pass'

Ddefault_var

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default' instead of 'default_var'

Not assigning the default value as a string

The correct parameter to set a default value is default_var with the desired default string.

3fill in blank

hard

Fix the error in the code to correctly fetch a secret from Airflow's connection backend.

Apache Airflow

from airflow.hooks.base import BaseHook

conn = BaseHook.get_connection([1])
print(conn.password)

Drag options to blanks, or click blank then click option'

Amy_conn_id

B'my_conn_id'

Cmy_conn_id()

D"my_conn_id"

Attempts:

3 left

💡 Hint

Common Mistakes

Passing the connection ID without quotes

Calling the connection ID as a function

The connection ID must be passed as a string with quotes to get_connection().

4fill in blank

hard

Fill both blanks to create a dictionary comprehension that stores secret names and their values from Airflow Variables.

Apache Airflow

secrets = { [1]: Variable.get([2]) for [1] in secret_names }

Drag options to blanks, or click blank then click option'

Aname

B'name'

Csecret

Dsecret_names

Attempts:

3 left

💡 Hint

Common Mistakes

Using quotes around the key in the dictionary

Using different variable names in key and get()

The variable name used in the loop and as the key must be the same identifier without quotes.

5fill in blank

hard

Fill all three blanks to filter Airflow Variables whose values are not empty strings.

Apache Airflow

filtered_vars = { [1]: Variable.get([2]) for [1] in Variable.get_all() if Variable.get([3]) != '' }

Drag options to blanks, or click blank then click option'

Akey

B'key'

Attempts:

3 left

💡 Hint

Common Mistakes

Using quotes around the variable name in get()

Using different variable names in the comprehension

The loop variable key is used as the dictionary key, and to get the variable value. It must be without quotes.

Practice

1. What is the main purpose of secrets management in Apache Airflow?

easy

A. To keep sensitive information like passwords out of the code

B. To speed up DAG execution

C. To store large datasets

D. To monitor task progress visually

Solution

1. Step 1: Understand what secrets management means

   Secrets management is about protecting sensitive data such as passwords or API keys from being exposed in code.

2. Step 2: Identify the main goal in Airflow context

   Airflow uses secrets management to keep such sensitive info safe and separate from DAG code.

3. Final Answer:

   To keep sensitive information like passwords out of the code -> Option A

4. Quick Check:

   Secrets management = protect sensitive info [OK]

Hint: Secrets management means hiding passwords from code [OK]

Common Mistakes:

• Confusing secrets management with data storage
• Thinking it speeds up DAGs
• Assuming it monitors tasks

2. Which of the following is the correct way to retrieve a secret stored as an Airflow Variable in a DAG?

easy

A. get_variable('my_secret')

B. Variable.get('my_secret')

C. Variable.fetch('my_secret')

D. fetch_variable('my_secret')

Solution

1. Step 1: Recall Airflow's Variable API

   Airflow provides a Variable class with a get() method to access stored variables or secrets.

2. Step 2: Match the correct syntax

   The correct method call is Variable.get('variable_name'), so Variable.get('my_secret') is correct.

3. Final Answer:

   Variable.get('my_secret') -> Option B

4. Quick Check:

   Use Variable.get() to access secrets [OK]

Hint: Use Variable.get() to fetch secrets in Airflow [OK]

Common Mistakes:

• Using non-existent methods like fetch or get_variable
• Confusing function names
• Missing the Variable class prefix

3. Given this Airflow DAG snippet, what will be the output if the secret 'db_password' is stored as 'mypassword123' in Airflow Variables?

from airflow.models import Variable

password = Variable.get('db_password')
print(password)

medium

A. Error: Variable not found

B. db_password

C. Variable.get('db_password')

D. mypassword123

Solution

1. Step 1: Understand Variable.get() behavior

   Variable.get('db_password') fetches the value stored under 'db_password' key, which is 'mypassword123'.

2. Step 2: Predict the print output

   Printing the variable will output the string 'mypassword123'.

3. Final Answer:

   mypassword123 -> Option D

4. Quick Check:

   Variable.get() returns stored secret value [OK]

Hint: Variable.get() returns the secret's stored value [OK]

Common Mistakes:

• Thinking it prints the key name
• Expecting the method call as output
• Assuming an error without checking storage

4. You wrote this code in your Airflow DAG to get a secret:

from airflow.models import Variable

api_key = Variable.get('api_key')

But you get an error: "KeyError: 'api_key' not found". What is the best way to fix this?

medium

A. Add a default value like Variable.get('api_key', default_var='default')

B. Change Variable.get to Variable.fetch

C. Remove the import statement

D. Rename 'api_key' to 'API_KEY'

Solution

1. Step 1: Understand the error cause

   The error means 'api_key' variable does not exist in Airflow Variables, so Variable.get() fails.

2. Step 2: Use default_var to avoid error

   Adding default_var='default' returns 'default' if the variable is missing, preventing the error.

3. Final Answer:

   Add a default value like Variable.get('api_key', default_var='default') -> Option A

4. Quick Check:

   Use default_var to handle missing secrets safely [OK]

Hint: Use default_var to avoid missing variable errors [OK]

Common Mistakes:

• Using non-existent Variable.fetch method
• Removing imports breaks code
• Changing variable name without updating storage

5. You want to securely store and access AWS credentials in Airflow using AWS Secrets Manager. Which approach correctly integrates this with Airflow's secrets backend?

hard

A. Hardcode AWS credentials in DAG files for faster access

B. Store credentials in Airflow Variables and access with Variable.get() only

C. Configure airflow.cfg with [secrets] backend = airflow.providers.amazon.aws.secrets.secrets_manager.SecretsManagerBackend

D. Use environment variables without any Airflow configuration

Solution

1. Step 1: Identify how Airflow integrates with AWS Secrets Manager

   Airflow supports multiple secrets backends configured in airflow.cfg under the [secrets] section.

2. Step 2: Correctly configure the secrets backend

   Setting backend to airflow.providers.amazon.aws.secrets.secrets_manager.SecretsManagerBackend enables Airflow to fetch secrets from AWS Secrets Manager securely.

3. Final Answer:

   Configure airflow.cfg with [secrets] backend = airflow.providers.amazon.aws.secrets.secrets_manager.SecretsManagerBackend -> Option C

4. Quick Check:

   Configure secrets backend for AWS Secrets Manager [OK]

Hint: Set secrets backend in airflow.cfg for AWS Secrets Manager [OK]

Common Mistakes:

• Hardcoding credentials in DAGs (unsafe)
• Using Variables only without backend config
• Ignoring Airflow secrets backend configuration