Role-based access control (RBAC) in Apache Airflow - Commands & Configuration

Introduction

Role-based access control (RBAC) helps you control who can do what in Apache Airflow. It solves the problem of managing permissions for different users by assigning roles with specific access rights.

When you want to let some users only view workflows but not change them

When you need to allow operators to trigger tasks but not modify DAGs

When you want to restrict access to sensitive data or logs to certain users

When you want to manage permissions easily by grouping users into roles

When you want to audit who accessed or changed Airflow resources

Config File - airflow.cfg

airflow.cfg

[webserver]
rbac = True

[api]
auth_backend = airflow.api.auth.backend.basic_auth

[security]
# Default roles: Admin, User, Op, Viewer

This configuration file enables RBAC in Airflow by setting rbac = True under the webserver section. It also configures basic authentication for the API. The security section notes the default roles available for assignment.

Commands

This command creates a new Airflow user named Alice with the Admin role, giving her full access to Airflow features.

Terminal

airflow users create --username alice --firstname Alice --lastname Smith --role Admin --email [e-mail]

Expected Output

User "alice" created successfully

→

--username - Sets the username for the new user

→

--role - Assigns the role that defines permissions

→

--email - Sets the user's email address

This command creates a user named Bob with the Viewer role, allowing him to only view Airflow resources without making changes.

Terminal

airflow users create --username bob --firstname Bob --lastname Lee --role Viewer --email [e-mail]

Expected Output

User "bob" created successfully

→

--role - Assigns read-only permissions to the user

This command lists all users and their roles to verify who has access and what permissions they have.

Terminal

airflow users list

Expected Output

Username  Firstname  Lastname  Email              Role

alice     Alice      Smith     [e-mail]  Admin

bob       Bob        Lee       [e-mail]    Viewer

This command shows all available roles in Airflow and their permissions to help you decide which role to assign.

Terminal

airflow roles list

Expected Output

Role

Admin

User

Op

Viewer

Key Concept

If you remember nothing else from RBAC, remember: assign roles to users to control exactly what they can see and do in Airflow.

Common Mistakes

Not enabling RBAC in airflow.cfg before creating users

Users and roles won't be recognized without RBAC enabled, so permissions won't work

Set 'rbac = True' under the [webserver] section in airflow.cfg and restart Airflow

Assigning Admin role to all users by default

Gives unnecessary full access, increasing security risks

Assign least privilege roles like Viewer or User unless full access is needed

Not verifying user roles with 'airflow users list'

You might not notice wrong or missing permissions causing access issues

Regularly run 'airflow users list' to confirm correct role assignments

Summary

Enable RBAC in airflow.cfg by setting 'rbac = True' under the webserver section.

Create users with specific roles using 'airflow users create' to control access.

Use 'airflow users list' and 'airflow roles list' to verify users and available roles.

Practice

1. What is the main purpose of Role-Based Access Control (RBAC) in Apache Airflow?

easy

A. To assign users specific roles that define their permissions

B. To schedule DAG runs automatically

C. To monitor system resource usage

D. To create new DAGs from templates

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling who can do what by assigning roles with permissions.

2. Step 2: Identify RBAC purpose in Airflow

   In Airflow, RBAC assigns roles to users to control access to features and data.

3. Final Answer:

   To assign users specific roles that define their permissions -> Option A

4. Quick Check:

   RBAC = Assign roles with permissions [OK]

Hint: RBAC means roles control user permissions [OK]

Common Mistakes:

• Confusing RBAC with scheduling tasks
• Thinking RBAC monitors system resources
• Believing RBAC creates DAGs

2. Which Airflow CLI command correctly creates a user with the role 'Admin'?

easy

A. airflow users create --username alice --role Admin --email [e-mail]

B. airflow create user --name alice --role Admin

C. airflow user add --username alice --role Admin

D. airflow users add --user alice --role Admin

Solution

1. Step 1: Recall correct CLI syntax for user creation

   The correct command uses 'airflow users create' with flags for username, role, and email.

2. Step 2: Match options to syntax

   airflow users create --username alice --role Admin --email [e-mail] matches the correct syntax exactly; others have wrong commands or flags.

3. Final Answer:

   airflow users create --username alice --role Admin --email [e-mail] -> Option A

4. Quick Check:

   Correct CLI syntax = airflow users create --username alice --role Admin --email [e-mail] [OK]

Hint: Use 'airflow users create' with proper flags [OK]

Common Mistakes:

• Using 'create user' instead of 'users create'
• Missing required flags like --email
• Using incorrect command verbs like 'add'

3. Given this Airflow RBAC role assignment command, what will be the user's role?

airflow users create --username bob --role Viewer --email [e-mail]

medium

A. User

B. Admin

C. Viewer

D. Operator

Solution

1. Step 1: Read the command carefully

   The command assigns the role 'Viewer' to user 'bob'.

2. Step 2: Identify the assigned role

   The role specified with --role is 'Viewer', so that is the user's role.

3. Final Answer:

   Viewer -> Option C

4. Quick Check:

   Role assigned = Viewer [OK]

Hint: Look for --role flag value in command [OK]

Common Mistakes:

• Assuming default role instead of specified
• Confusing username with role
• Choosing a role not in the command

4. You run this command but get an error:

airflow users create --username carol --role Admin

What is the most likely cause?

medium

A. Username 'carol' already exists

B. Role 'Admin' does not exist

C. Incorrect command 'users create'

D. Missing required --email flag

Solution

1. Step 1: Check required flags for user creation

   The 'airflow users create' command requires --email flag along with username and role.

2. Step 2: Identify missing flag causing error

   The command lacks --email, so it triggers an error for missing required argument.

3. Final Answer:

   Missing required --email flag -> Option D

4. Quick Check:

   Required flags missing = Missing required --email flag [OK]

Hint: Always include --email when creating users [OK]

Common Mistakes:

• Ignoring required flags
• Assuming role names cause error
• Thinking command syntax is wrong

5. You want to restrict a user to only view DAGs but not edit or trigger them. Which role should you assign in Airflow RBAC to achieve this?

hard

A. Admin

B. Viewer

C. User

D. Op

Solution

1. Step 1: Understand role permissions in Airflow

   'Admin' has full access, 'User' and 'Op' have more permissions than just viewing.

2. Step 2: Identify role for view-only access

   'Viewer' role is designed to allow users to see DAGs without editing or triggering them.

3. Final Answer:

   Viewer -> Option B

4. Quick Check:

   View-only access = Viewer role [OK]

Hint: Use 'Viewer' role for read-only DAG access [OK]

Common Mistakes:

• Assigning Admin role for limited access
• Confusing 'User' or 'Op' with view-only
• Not knowing role permission differences