Variable encryption for secrets in Apache Airflow - Commands & Configuration

Introduction

When you store sensitive information like passwords or API keys in Airflow variables, you want to keep them safe. Variable encryption helps protect these secrets so only authorized parts of your system can read them.

When you need to store database passwords securely in Airflow variables.

When your workflows require API keys that should not be visible in plain text.

When you want to prevent accidental exposure of secrets in logs or UI.

When multiple team members use Airflow but only some should access sensitive data.

When you want to comply with security policies requiring encrypted secrets.

Config File - airflow.cfg

airflow.cfg

[secrets]
enable_variable_encryption = True

[core]
fernet_key = 3x4mpl3F3rn3tK3y1234567890abcdefgHIJKLmnopqrs=

The enable_variable_encryption option turns on encryption for Airflow variables.

The fernet_key under the [core] section is the secret key used to encrypt and decrypt variables. It must be a valid Fernet key.

Commands

This command stores a variable named my_secret_password with the value supersecret123. Because encryption is enabled, the value is stored encrypted.

Terminal

airflow variables set my_secret_password supersecret123

Expected Output

No output (command runs silently)

This command retrieves the decrypted value of the variable my_secret_password. Airflow automatically decrypts it using the Fernet key.

Terminal

airflow variables get my_secret_password

Expected Output

supersecret123

This command lists all variables stored in Airflow. Encrypted values are not shown here, only variable names.

Terminal

airflow variables list

Expected Output

my_secret_password

Key Concept

If you remember nothing else from this pattern, remember: Airflow uses a Fernet key to encrypt variables so secrets stay safe and only decrypt when accessed with the right key.

Common Mistakes

Not setting a valid Fernet key in airflow.cfg before enabling variable encryption.

Without a valid Fernet key, Airflow cannot encrypt or decrypt variables, causing errors or storing secrets in plain text.

Generate a Fernet key using 'python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"' and set it in airflow.cfg under [core] as fernet_key.

Changing the Fernet key after variables are encrypted.

Changing the key breaks decryption of existing variables, making secrets inaccessible.

Keep the Fernet key constant or rotate it carefully using Airflow's key rotation procedures.

Storing secrets in variables without enabling encryption.

Secrets will be stored in plain text and visible to anyone with access to the Airflow metadata database or UI.

Always enable variable encryption in airflow.cfg before storing sensitive data.

Summary

Enable variable encryption by setting enable_variable_encryption = True and a valid fernet_key in airflow.cfg.

Use 'airflow variables set' to store secrets; they are encrypted automatically.

Retrieve secrets with 'airflow variables get' which decrypts them transparently.

Practice

1. What is the main purpose of encrypting variables in Airflow?

easy

A. To keep sensitive data like passwords safe from unauthorized access

B. To speed up the execution of DAGs

C. To reduce the size of variable storage

D. To make variables visible in the Airflow UI

Solution

1. Step 1: Understand variable encryption purpose

   Encryption protects sensitive information by making it unreadable without a key.

2. Step 2: Relate to Airflow variables

   Airflow encrypts variables to keep secrets like passwords safe from unauthorized users.

3. Final Answer:

   To keep sensitive data like passwords safe from unauthorized access -> Option A

4. Quick Check:

   Encryption = Protect secrets [OK]

Hint: Encryption means hiding secrets safely [OK]

Common Mistakes:

• Thinking encryption speeds up DAGs
• Confusing encryption with compression
• Believing encryption makes variables visible

2. Which command correctly sets an encrypted variable named API_KEY with value 12345 in Airflow CLI?

easy

A. airflow variables set --encrypt API_KEY 12345

B. airflow variables set API_KEY --encrypt 12345

C. airflow variables set API_KEY 12345 --encrypt

D. airflow variables set 12345 API_KEY --encrypt

Solution

1. Step 1: Recall Airflow CLI syntax for encrypted variables

   The correct syntax places the --encrypt flag before the variable name and value.

2. Step 2: Match syntax with options

   airflow variables set --encrypt API_KEY 12345 uses airflow variables set --encrypt API_KEY 12345, which is correct.

3. Final Answer:

   airflow variables set --encrypt API_KEY 12345 -> Option A

4. Quick Check:

   Flag before name and value = airflow variables set --encrypt API_KEY 12345 [OK]

Hint: Put --encrypt right after 'set' command [OK]

Common Mistakes:

• Placing --encrypt after variable name or value
• Swapping variable name and value order
• Omitting --encrypt flag

3. Given the following code snippet in an Airflow DAG:

from airflow.models import Variable
secret = Variable.get('MY_SECRET')

What will secret contain if MY_SECRET was set with encryption?

medium

A. The encrypted string stored in Airflow

B. The decrypted original secret value

C. An error because encrypted variables cannot be read

D. None, because encrypted variables are hidden

Solution

1. Step 1: Understand Variable.get behavior with encrypted variables

   Airflow automatically decrypts encrypted variables when accessed via Variable.get.

2. Step 2: Determine what secret holds

   It holds the original decrypted secret value, not the encrypted string or None.

3. Final Answer:

   The decrypted original secret value -> Option B

4. Quick Check:

   Variable.get decrypts automatically [OK]

Hint: Variable.get returns decrypted value automatically [OK]

Common Mistakes:

• Expecting encrypted string instead of decrypted
• Assuming Variable.get raises error for encrypted vars
• Thinking encrypted vars are hidden and return None

4. You tried to set an encrypted variable with this command:
airflow variables set API_SECRET 98765 --encrypt
But the variable is not encrypted. What is the likely mistake?

medium

A. The value must be base64 encoded before setting

B. The variable name cannot contain underscores

C. You must restart Airflow for encryption to work

D. The --encrypt flag should come before the variable name and value

Solution

1. Step 1: Check correct placement of --encrypt flag

   The flag must be placed immediately after set, before variable name and value.

2. Step 2: Analyze the command given

   The flag is placed after value, so encryption is not applied.

3. Final Answer:

   The --encrypt flag should come before the variable name and value -> Option D

4. Quick Check:

   Flag position matters for encryption [OK]

Hint: Place --encrypt right after 'set' command [OK]

Common Mistakes:

• Putting --encrypt after value
• Restarting Airflow unnecessarily
• Encoding value manually before setting

5. You want to securely store multiple secrets as Airflow variables encrypted at once. Which approach is best?

hard

A. Store all secrets in a plain text file and upload it to Airflow UI

B. Set variables without encryption and rely on OS file permissions

C. Write a script that uses airflow variables set --encrypt for each secret

D. Use Airflow connections instead of variables for secrets

Solution

1. Step 1: Understand best practice for multiple encrypted variables

   Using a script automates setting each secret with encryption flag, ensuring safety.

2. Step 2: Evaluate other options

   Uploading plain text or skipping encryption risks exposure; connections are different concept.

3. Final Answer:

   Write a script that uses airflow variables set --encrypt for each secret -> Option C

4. Quick Check:

   Automate encrypted variable setting for multiple secrets [OK]

Hint: Automate with script using --encrypt flag [OK]

Common Mistakes:

• Uploading plain text files
• Ignoring encryption for secrets
• Confusing variables with connections