Role-based access control (RBAC) in Apache Airflow - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Role-based Access Control (RBAC) in Airflow?

RBAC in Airflow is a way to manage user permissions by assigning roles. Each role has specific access rights to Airflow features, making it easier to control who can do what.

beginner

Name two default roles provided by Airflow's RBAC system.

Two default roles are 'Admin' which has full access, and 'User' which has limited access to view and trigger DAGs but cannot change system settings.

beginner

How do you assign a role to a user in Airflow's RBAC?

You assign a role to a user via the Airflow UI under 'Security' > 'Users'. Select the user and choose the role(s) to grant the appropriate permissions.

beginner

Why is RBAC important in Airflow?

RBAC helps keep Airflow secure by limiting access based on roles. It prevents unauthorized users from making changes or viewing sensitive data.

intermediate

What command enables RBAC in Airflow's configuration?

Set `rbac = True` in the `[webserver]` section of the airflow.cfg file to enable RBAC.

What does RBAC stand for in Airflow?

A Read-Block Access Control

B Role-based Access Control

C Random Backup Access Control

D Resource-based Access Control

RBAC stands for Role-based Access Control, a method to assign permissions based on user roles.

Which Airflow role typically has full access to all features?

A Operator

B Viewer

C User

D Admin

The Admin role has full access to all Airflow features including configuration and user management.

How do you enable RBAC in Airflow?

A Set `rbac = True` in airflow.cfg under [webserver]

B Run `airflow enable rbac` command

C RBAC is enabled by default

D Add users to the admin group

You enable RBAC by setting `rbac = True` in the airflow.cfg file under the [webserver] section.

Where do you assign roles to users in Airflow?

A In airflow.cfg file

B Using the command line only

C In the Airflow UI under Security > Users

D Roles are assigned automatically

Roles are assigned to users via the Airflow UI under the Security > Users section.

What is a key benefit of using RBAC in Airflow?

A Improves security by limiting access

B Simplifies user interface

C Faster DAG execution

D Automatically fixes DAG errors

RBAC improves security by limiting user access based on roles, preventing unauthorized actions.

Explain how RBAC works in Airflow and why it is useful.

Think about how roles help control what users can do.

Describe the steps to enable and configure RBAC in Airflow.

Focus on configuration and user role assignment.

Practice

1. What is the main purpose of Role-Based Access Control (RBAC) in Apache Airflow?

easy

A. To assign users specific roles that define their permissions

B. To schedule DAG runs automatically

C. To monitor system resource usage

D. To create new DAGs from templates

Solution

1. Step 1: Understand RBAC concept

   RBAC is about controlling who can do what by assigning roles with permissions.

2. Step 2: Identify RBAC purpose in Airflow

   In Airflow, RBAC assigns roles to users to control access to features and data.

3. Final Answer:

   To assign users specific roles that define their permissions -> Option A

4. Quick Check:

   RBAC = Assign roles with permissions [OK]

Hint: RBAC means roles control user permissions [OK]

Common Mistakes:

• Confusing RBAC with scheduling tasks
• Thinking RBAC monitors system resources
• Believing RBAC creates DAGs

2. Which Airflow CLI command correctly creates a user with the role 'Admin'?

easy

A. airflow users create --username alice --role Admin --email [e-mail]

B. airflow create user --name alice --role Admin

C. airflow user add --username alice --role Admin

D. airflow users add --user alice --role Admin

Solution

1. Step 1: Recall correct CLI syntax for user creation

   The correct command uses 'airflow users create' with flags for username, role, and email.

2. Step 2: Match options to syntax

   airflow users create --username alice --role Admin --email [e-mail] matches the correct syntax exactly; others have wrong commands or flags.

3. Final Answer:

   airflow users create --username alice --role Admin --email [e-mail] -> Option A

4. Quick Check:

   Correct CLI syntax = airflow users create --username alice --role Admin --email [e-mail] [OK]

Hint: Use 'airflow users create' with proper flags [OK]

Common Mistakes:

• Using 'create user' instead of 'users create'
• Missing required flags like --email
• Using incorrect command verbs like 'add'

3. Given this Airflow RBAC role assignment command, what will be the user's role?

airflow users create --username bob --role Viewer --email [e-mail]

medium

A. User

B. Admin

C. Viewer

D. Operator

Solution

1. Step 1: Read the command carefully

   The command assigns the role 'Viewer' to user 'bob'.

2. Step 2: Identify the assigned role

   The role specified with --role is 'Viewer', so that is the user's role.

3. Final Answer:

   Viewer -> Option C

4. Quick Check:

   Role assigned = Viewer [OK]

Hint: Look for --role flag value in command [OK]

Common Mistakes:

• Assuming default role instead of specified
• Confusing username with role
• Choosing a role not in the command

4. You run this command but get an error:

airflow users create --username carol --role Admin

What is the most likely cause?

medium

A. Username 'carol' already exists

B. Role 'Admin' does not exist

C. Incorrect command 'users create'

D. Missing required --email flag

Solution

1. Step 1: Check required flags for user creation

   The 'airflow users create' command requires --email flag along with username and role.

2. Step 2: Identify missing flag causing error

   The command lacks --email, so it triggers an error for missing required argument.

3. Final Answer:

   Missing required --email flag -> Option D

4. Quick Check:

   Required flags missing = Missing required --email flag [OK]

Hint: Always include --email when creating users [OK]

Common Mistakes:

• Ignoring required flags
• Assuming role names cause error
• Thinking command syntax is wrong

5. You want to restrict a user to only view DAGs but not edit or trigger them. Which role should you assign in Airflow RBAC to achieve this?

hard

A. Admin

B. Viewer

C. User

D. Op

Solution

1. Step 1: Understand role permissions in Airflow

   'Admin' has full access, 'User' and 'Op' have more permissions than just viewing.

2. Step 2: Identify role for view-only access

   'Viewer' role is designed to allow users to see DAGs without editing or triggering them.

3. Final Answer:

   Viewer -> Option B

4. Quick Check:

   View-only access = Viewer role [OK]

Hint: Use 'Viewer' role for read-only DAG access [OK]

Common Mistakes:

• Assigning Admin role for limited access
• Confusing 'User' or 'Op' with view-only
• Not knowing role permission differences