Variable encryption for secrets in Apache Airflow - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why encrypt Airflow variables containing secrets?

Airflow variables can store sensitive data like API keys. Why is it important to encrypt these variables?

A To make the variables load faster during DAG execution.

B To allow variables to be shared publicly without restrictions.

C To prevent unauthorized users from reading sensitive data if they access the metadata database.

D To reduce the size of the metadata database.

💡 Hint

Think about what happens if someone gains access to the Airflow database.

Encrypting variables protects sensitive data from being exposed if the metadata database is accessed by unauthorized users. It does not affect performance or sharing.

💻 Command Output

intermediate

Output of enabling variable encryption in Airflow config

What is the output when you run airflow config get-value core encrypt_variable after setting encrypt_variable = True in airflow.cfg?

A False

B True

C None

D Error: option not found

💡 Hint

Check the exact value you set in the config file.

Setting encrypt_variable = True enables encryption, so the command returns True.

🔀 Workflow

advanced

Steps to enable variable encryption in Airflow

Arrange the steps to enable variable encryption in Airflow in the correct order.

A 1,2,3,4

B 2,1,3,4

C 1,3,2,4

D 3,1,2,4

💡 Hint

You need the key before setting it in the config.

First generate the Fernet key, then set it in the config, enable encryption, and finally restart Airflow services.

❓ Troubleshoot

advanced

Error when decrypting Airflow variables after changing Fernet key

You changed the Fernet key in airflow.cfg but now Airflow raises errors when accessing encrypted variables. What is the cause?

A The new Fernet key does not match the key used to encrypt existing variables.

B Variable encryption must be disabled before changing the key.

C The Airflow database is corrupted and needs repair.

D The Airflow version does not support variable encryption.

💡 Hint

Think about how encryption keys work with encrypted data.

Encrypted variables can only be decrypted with the same Fernet key used during encryption. Changing the key breaks decryption.

✅ Best Practice

expert

Best practice for managing Fernet keys in Airflow variable encryption

Which option is the best practice for managing Fernet keys to ensure secure and reliable Airflow variable encryption?

A Share the Fernet key publicly to allow team members to decrypt variables.

B Hardcode the Fernet key in DAG files for easy access.

C Use the default Fernet key generated by Airflow without changes.

D Store the Fernet key securely outside the Airflow server and rotate it periodically with a key management system.

💡 Hint

Consider security and operational reliability.

Storing keys securely and rotating them with a key management system reduces risk of exposure and supports secure operations.

Practice

1. What is the main purpose of encrypting variables in Airflow?

easy

A. To keep sensitive data like passwords safe from unauthorized access

B. To speed up the execution of DAGs

C. To reduce the size of variable storage

D. To make variables visible in the Airflow UI

Solution

1. Step 1: Understand variable encryption purpose

   Encryption protects sensitive information by making it unreadable without a key.

2. Step 2: Relate to Airflow variables

   Airflow encrypts variables to keep secrets like passwords safe from unauthorized users.

3. Final Answer:

   To keep sensitive data like passwords safe from unauthorized access -> Option A

4. Quick Check:

   Encryption = Protect secrets [OK]

Hint: Encryption means hiding secrets safely [OK]

Common Mistakes:

• Thinking encryption speeds up DAGs
• Confusing encryption with compression
• Believing encryption makes variables visible

2. Which command correctly sets an encrypted variable named API_KEY with value 12345 in Airflow CLI?

easy

A. airflow variables set --encrypt API_KEY 12345

B. airflow variables set API_KEY --encrypt 12345

C. airflow variables set API_KEY 12345 --encrypt

D. airflow variables set 12345 API_KEY --encrypt

Solution

1. Step 1: Recall Airflow CLI syntax for encrypted variables

   The correct syntax places the --encrypt flag before the variable name and value.

2. Step 2: Match syntax with options

   airflow variables set --encrypt API_KEY 12345 uses airflow variables set --encrypt API_KEY 12345, which is correct.

3. Final Answer:

   airflow variables set --encrypt API_KEY 12345 -> Option A

4. Quick Check:

   Flag before name and value = airflow variables set --encrypt API_KEY 12345 [OK]

Hint: Put --encrypt right after 'set' command [OK]

Common Mistakes:

• Placing --encrypt after variable name or value
• Swapping variable name and value order
• Omitting --encrypt flag

3. Given the following code snippet in an Airflow DAG:

from airflow.models import Variable
secret = Variable.get('MY_SECRET')

What will secret contain if MY_SECRET was set with encryption?

medium

A. The encrypted string stored in Airflow

B. The decrypted original secret value

C. An error because encrypted variables cannot be read

D. None, because encrypted variables are hidden

Solution

1. Step 1: Understand Variable.get behavior with encrypted variables

   Airflow automatically decrypts encrypted variables when accessed via Variable.get.

2. Step 2: Determine what secret holds

   It holds the original decrypted secret value, not the encrypted string or None.

3. Final Answer:

   The decrypted original secret value -> Option B

4. Quick Check:

   Variable.get decrypts automatically [OK]

Hint: Variable.get returns decrypted value automatically [OK]

Common Mistakes:

• Expecting encrypted string instead of decrypted
• Assuming Variable.get raises error for encrypted vars
• Thinking encrypted vars are hidden and return None

4. You tried to set an encrypted variable with this command:
airflow variables set API_SECRET 98765 --encrypt
But the variable is not encrypted. What is the likely mistake?

medium

A. The value must be base64 encoded before setting

B. The variable name cannot contain underscores

C. You must restart Airflow for encryption to work

D. The --encrypt flag should come before the variable name and value

Solution

1. Step 1: Check correct placement of --encrypt flag

   The flag must be placed immediately after set, before variable name and value.

2. Step 2: Analyze the command given

   The flag is placed after value, so encryption is not applied.

3. Final Answer:

   The --encrypt flag should come before the variable name and value -> Option D

4. Quick Check:

   Flag position matters for encryption [OK]

Hint: Place --encrypt right after 'set' command [OK]

Common Mistakes:

• Putting --encrypt after value
• Restarting Airflow unnecessarily
• Encoding value manually before setting

5. You want to securely store multiple secrets as Airflow variables encrypted at once. Which approach is best?

hard

A. Store all secrets in a plain text file and upload it to Airflow UI

B. Set variables without encryption and rely on OS file permissions

C. Write a script that uses airflow variables set --encrypt for each secret

D. Use Airflow connections instead of variables for secrets

Solution

1. Step 1: Understand best practice for multiple encrypted variables

   Using a script automates setting each secret with encryption flag, ensuring safety.

2. Step 2: Evaluate other options

   Uploading plain text or skipping encryption risks exposure; connections are different concept.

3. Final Answer:

   Write a script that uses airflow variables set --encrypt for each secret -> Option C

4. Quick Check:

   Automate encrypted variable setting for multiple secrets [OK]

Hint: Automate with script using --encrypt flag [OK]

Common Mistakes:

• Uploading plain text files
• Ignoring encryption for secrets
• Confusing variables with connections