Variable encryption for secrets in Apache Airflow - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why encrypt Airflow variables containing secrets?

Airflow variables can store sensitive data like API keys. Why is it important to encrypt these variables?

A To make the variables load faster during DAG execution.

B To allow variables to be shared publicly without restrictions.

C To prevent unauthorized users from reading sensitive data if they access the metadata database.

D To reduce the size of the metadata database.

💡 Hint

Think about what happens if someone gains access to the Airflow database.

Encrypting variables protects sensitive data from being exposed if the metadata database is accessed by unauthorized users. It does not affect performance or sharing.

💻 Command Output

intermediate

Output of enabling variable encryption in Airflow config

What is the output when you run airflow config get-value core encrypt_variable after setting encrypt_variable = True in airflow.cfg?

A False

B True

C None

D Error: option not found

💡 Hint

Check the exact value you set in the config file.

Setting encrypt_variable = True enables encryption, so the command returns True.

🔀 Workflow

advanced

Steps to enable variable encryption in Airflow

Arrange the steps to enable variable encryption in Airflow in the correct order.

A 1,2,3,4

B 2,1,3,4

C 1,3,2,4

D 3,1,2,4

💡 Hint

You need the key before setting it in the config.

First generate the Fernet key, then set it in the config, enable encryption, and finally restart Airflow services.

❓ Troubleshoot

advanced

Error when decrypting Airflow variables after changing Fernet key

You changed the Fernet key in airflow.cfg but now Airflow raises errors when accessing encrypted variables. What is the cause?

A The new Fernet key does not match the key used to encrypt existing variables.

B Variable encryption must be disabled before changing the key.

C The Airflow database is corrupted and needs repair.

D The Airflow version does not support variable encryption.

💡 Hint

Think about how encryption keys work with encrypted data.

Encrypted variables can only be decrypted with the same Fernet key used during encryption. Changing the key breaks decryption.

✅ Best Practice

expert

Best practice for managing Fernet keys in Airflow variable encryption

Which option is the best practice for managing Fernet keys to ensure secure and reliable Airflow variable encryption?

A Share the Fernet key publicly to allow team members to decrypt variables.

B Hardcode the Fernet key in DAG files for easy access.

C Use the default Fernet key generated by Airflow without changes.

D Store the Fernet key securely outside the Airflow server and rotate it periodically with a key management system.

💡 Hint

Consider security and operational reliability.

Storing keys securely and rotating them with a key management system reduces risk of exposure and supports secure operations.