Role-based access control (RBAC) in Apache Airflow - Mini Project: Build & Apply

Role-based access control (RBAC) in Apache Airflow

📖 Scenario: You are managing an Apache Airflow environment where different users need different access levels. To keep things secure and organized, you want to set up role-based access control (RBAC). This means defining roles with specific permissions and assigning users to these roles.

🎯 Goal: Build a simple RBAC setup in Airflow by creating roles with permissions and assigning users to these roles using Python code. You will create roles, add permissions, and assign users to roles.

📋 What You'll Learn

Create roles with specific permissions

Assign users to roles

Use Airflow's RBAC API to manage roles and users

Print the roles and their assigned users

💡 Why This Matters

🌍 Real World

RBAC is used in Airflow to control who can see or change workflows, making sure only authorized people can do sensitive actions.

💼 Career

Understanding RBAC helps you manage access securely in real Airflow deployments, a key skill for DevOps and data engineering roles.

1

Create roles with permissions

Create two roles called data_engineer and data_analyst using Airflow's Role class. Add the permission can_read to data_analyst and permissions can_read and can_edit to data_engineer.

Apache Airflow

from airflow.www.fab_security.manager import Role

# Create roles data_engineer and data_analyst with permissions
# Your code here

Hint

Use the Role class to create roles and assign a set of permissions to the permissions attribute.

2

Create users and assign roles

Create two users called alice and bob using Airflow's User class. Assign the data_engineer role to alice and the data_analyst role to bob.

Apache Airflow

from airflow.www.fab_security.manager import Role

data_analyst = Role(name='data_analyst')
data_analyst.permissions = {'can_read'}
data_engineer = Role(name='data_engineer')
data_engineer.permissions = {'can_read', 'can_edit'}

from airflow.www.fab_security.manager import User

# Create users alice and bob and assign roles
# Your code here

Hint

Use the User class to create users and assign roles by setting the roles attribute to a set containing the role objects.

3

List roles and their users

Create a dictionary called role_users that maps each role name (data_engineer and data_analyst) to a list of usernames assigned to that role. Use a for loop to check each user and add their username to the correct role list.

Apache Airflow

from airflow.www.fab_security.manager import Role

data_analyst = Role(name='data_analyst')
data_analyst.permissions = {'can_read'}
data_engineer = Role(name='data_engineer')
data_engineer.permissions = {'can_read', 'can_edit'}

from airflow.www.fab_security.manager import User

alice = User(username='alice')
alice.roles = {data_engineer}
bob = User(username='bob')
bob.roles = {data_analyst}

role_users = {'data_engineer': [], 'data_analyst': []}

# Use a for loop with variables user and role to fill role_users
# Your code here

Hint

Loop over the list of users, then loop over each user's roles. Add the username to the list in role_users for the matching role name.

4

Print roles and assigned users

Print the role_users dictionary to display the roles and their assigned users.

Apache Airflow

from airflow.www.fab_security.manager import Role

data_analyst = Role(name='data_analyst')
data_analyst.permissions = {'can_read'}
data_engineer = Role(name='data_engineer')
data_engineer.permissions = {'can_read', 'can_edit'}

from airflow.www.fab_security.manager import User

alice = User(username='alice')
alice.roles = {data_engineer}
bob = User(username='bob')
bob.roles = {data_analyst}

role_users = {'data_engineer': [], 'data_analyst': []}

for user in [alice, bob]:
    for role in user.roles:
        role_users[role.name].append(user.username)

# Print the role_users dictionary
# Your code here

Hint

Use print(role_users) to show the dictionary with roles and their users.

Practice

1. What is the main purpose of Role-Based Access Control (RBAC) in Apache Airflow?

easy

A. To assign users specific roles that define their permissions

B. To schedule DAG runs automatically

C. To monitor system resource usage

D. To create new DAGs from templates

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling who can do what by assigning roles with permissions.

2. Step 2: Identify RBAC purpose in Airflow

   In Airflow, RBAC assigns roles to users to control access to features and data.

3. Final Answer:

   To assign users specific roles that define their permissions -> Option A

4. Quick Check:

   RBAC = Assign roles with permissions [OK]

Hint: RBAC means roles control user permissions [OK]

Common Mistakes:

• Confusing RBAC with scheduling tasks
• Thinking RBAC monitors system resources
• Believing RBAC creates DAGs

2. Which Airflow CLI command correctly creates a user with the role 'Admin'?

easy

A. airflow users create --username alice --role Admin --email [e-mail]

B. airflow create user --name alice --role Admin

C. airflow user add --username alice --role Admin

D. airflow users add --user alice --role Admin

Solution

1. Step 1: Recall correct CLI syntax for user creation

   The correct command uses 'airflow users create' with flags for username, role, and email.

2. Step 2: Match options to syntax

   airflow users create --username alice --role Admin --email [e-mail] matches the correct syntax exactly; others have wrong commands or flags.

3. Final Answer:

   airflow users create --username alice --role Admin --email [e-mail] -> Option A

4. Quick Check:

   Correct CLI syntax = airflow users create --username alice --role Admin --email [e-mail] [OK]

Hint: Use 'airflow users create' with proper flags [OK]

Common Mistakes:

• Using 'create user' instead of 'users create'
• Missing required flags like --email
• Using incorrect command verbs like 'add'

3. Given this Airflow RBAC role assignment command, what will be the user's role?

airflow users create --username bob --role Viewer --email [e-mail]

medium

A. User

B. Admin

C. Viewer

D. Operator

Solution

1. Step 1: Read the command carefully

   The command assigns the role 'Viewer' to user 'bob'.

2. Step 2: Identify the assigned role

   The role specified with --role is 'Viewer', so that is the user's role.

3. Final Answer:

   Viewer -> Option C

4. Quick Check:

   Role assigned = Viewer [OK]

Hint: Look for --role flag value in command [OK]

Common Mistakes:

• Assuming default role instead of specified
• Confusing username with role
• Choosing a role not in the command

4. You run this command but get an error:

airflow users create --username carol --role Admin

What is the most likely cause?

medium

A. Username 'carol' already exists

B. Role 'Admin' does not exist

C. Incorrect command 'users create'

D. Missing required --email flag

Solution

1. Step 1: Check required flags for user creation

   The 'airflow users create' command requires --email flag along with username and role.

2. Step 2: Identify missing flag causing error

   The command lacks --email, so it triggers an error for missing required argument.

3. Final Answer:

   Missing required --email flag -> Option D

4. Quick Check:

   Required flags missing = Missing required --email flag [OK]

Hint: Always include --email when creating users [OK]

Common Mistakes:

• Ignoring required flags
• Assuming role names cause error
• Thinking command syntax is wrong

5. You want to restrict a user to only view DAGs but not edit or trigger them. Which role should you assign in Airflow RBAC to achieve this?

hard

A. Admin

B. Viewer

C. User

D. Op

Solution

1. Step 1: Understand role permissions in Airflow

   'Admin' has full access, 'User' and 'Op' have more permissions than just viewing.

2. Step 2: Identify role for view-only access

   'Viewer' role is designed to allow users to see DAGs without editing or triggering them.

3. Final Answer:

   Viewer -> Option B

4. Quick Check:

   View-only access = Viewer role [OK]

Hint: Use 'Viewer' role for read-only DAG access [OK]

Common Mistakes:

• Assigning Admin role for limited access
• Confusing 'User' or 'Op' with view-only
• Not knowing role permission differences