Variable encryption for secrets in Apache Airflow - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of variable encryption in Airflow?

Variable encryption in Airflow protects sensitive information like passwords or API keys by storing them in an encrypted form, so only authorized users or systems can read them.

intermediate

Which Airflow component is responsible for encrypting variables?

The Airflow metadata database stores variables, and encryption is handled by the Fernet key configured in Airflow's settings to encrypt and decrypt variable values.

beginner

How do you enable variable encryption in Airflow?

Set the 'fernet_key' in the airflow.cfg configuration file with a valid Fernet key. Airflow will then use this key to encrypt and decrypt variables automatically.

intermediate

What happens if the Fernet key is lost or changed in Airflow?

If the Fernet key is lost or changed, Airflow cannot decrypt previously encrypted variables, causing secret data to become inaccessible until the original key is restored.

beginner

Why is it better to use Airflow's variable encryption instead of storing secrets in plain text?

Encrypting variables prevents unauthorized users from reading sensitive data directly from the database or configuration files, reducing the risk of data leaks and improving security.

What configuration setting enables variable encryption in Airflow?

A fernet_key

B secret_key

C encryption_enabled

D variable_encryption

The 'fernet_key' setting in airflow.cfg is used to enable encryption and decryption of variables.

What is the main risk if the Fernet key is lost?

A Airflow stops working

B Variables become readable by anyone

C Variables cannot be decrypted

D Variables get deleted automatically

Without the original Fernet key, Airflow cannot decrypt encrypted variables, making secrets inaccessible.

Where are Airflow variables stored?

A In the metadata database

B In the DAG files

C In environment variables

D In the Airflow logs

Airflow variables are stored in the metadata database, where encryption is applied if configured.

Which library does Airflow use for variable encryption?

A Hashlib

B PyCrypto

C OpenSSL

D Fernet from cryptography

Airflow uses Fernet encryption from the cryptography library to encrypt variables.

Why should secrets be encrypted rather than stored in plain text?

A To improve performance

B To prevent unauthorized access

C To reduce storage size

D To make variables easier to edit

Encryption protects secrets from unauthorized users by making the data unreadable without the key.

Explain how Airflow uses the Fernet key to secure variables.

Think about how a secret key locks and unlocks information.

Describe the consequences of losing the Fernet key in Airflow.

What happens if you lose the key to a locked box?

Practice

1. What is the main purpose of encrypting variables in Airflow?

easy

A. To keep sensitive data like passwords safe from unauthorized access

B. To speed up the execution of DAGs

C. To reduce the size of variable storage

D. To make variables visible in the Airflow UI

Solution

1. Step 1: Understand variable encryption purpose

   Encryption protects sensitive information by making it unreadable without a key.

2. Step 2: Relate to Airflow variables

   Airflow encrypts variables to keep secrets like passwords safe from unauthorized users.

3. Final Answer:

   To keep sensitive data like passwords safe from unauthorized access -> Option A

4. Quick Check:

   Encryption = Protect secrets [OK]

Hint: Encryption means hiding secrets safely [OK]

Common Mistakes:

• Thinking encryption speeds up DAGs
• Confusing encryption with compression
• Believing encryption makes variables visible

2. Which command correctly sets an encrypted variable named API_KEY with value 12345 in Airflow CLI?

easy

A. airflow variables set --encrypt API_KEY 12345

B. airflow variables set API_KEY --encrypt 12345

C. airflow variables set API_KEY 12345 --encrypt

D. airflow variables set 12345 API_KEY --encrypt

Solution

1. Step 1: Recall Airflow CLI syntax for encrypted variables

   The correct syntax places the --encrypt flag before the variable name and value.

2. Step 2: Match syntax with options

   airflow variables set --encrypt API_KEY 12345 uses airflow variables set --encrypt API_KEY 12345, which is correct.

3. Final Answer:

   airflow variables set --encrypt API_KEY 12345 -> Option A

4. Quick Check:

   Flag before name and value = airflow variables set --encrypt API_KEY 12345 [OK]

Hint: Put --encrypt right after 'set' command [OK]

Common Mistakes:

• Placing --encrypt after variable name or value
• Swapping variable name and value order
• Omitting --encrypt flag

3. Given the following code snippet in an Airflow DAG:

from airflow.models import Variable
secret = Variable.get('MY_SECRET')

What will secret contain if MY_SECRET was set with encryption?

medium

A. The encrypted string stored in Airflow

B. The decrypted original secret value

C. An error because encrypted variables cannot be read

D. None, because encrypted variables are hidden

Solution

1. Step 1: Understand Variable.get behavior with encrypted variables

   Airflow automatically decrypts encrypted variables when accessed via Variable.get.

2. Step 2: Determine what secret holds

   It holds the original decrypted secret value, not the encrypted string or None.

3. Final Answer:

   The decrypted original secret value -> Option B

4. Quick Check:

   Variable.get decrypts automatically [OK]

Hint: Variable.get returns decrypted value automatically [OK]

Common Mistakes:

• Expecting encrypted string instead of decrypted
• Assuming Variable.get raises error for encrypted vars
• Thinking encrypted vars are hidden and return None

4. You tried to set an encrypted variable with this command:
airflow variables set API_SECRET 98765 --encrypt
But the variable is not encrypted. What is the likely mistake?

medium

A. The value must be base64 encoded before setting

B. The variable name cannot contain underscores

C. You must restart Airflow for encryption to work

D. The --encrypt flag should come before the variable name and value

Solution

1. Step 1: Check correct placement of --encrypt flag

   The flag must be placed immediately after set, before variable name and value.

2. Step 2: Analyze the command given

   The flag is placed after value, so encryption is not applied.

3. Final Answer:

   The --encrypt flag should come before the variable name and value -> Option D

4. Quick Check:

   Flag position matters for encryption [OK]

Hint: Place --encrypt right after 'set' command [OK]

Common Mistakes:

• Putting --encrypt after value
• Restarting Airflow unnecessarily
• Encoding value manually before setting

5. You want to securely store multiple secrets as Airflow variables encrypted at once. Which approach is best?

hard

A. Store all secrets in a plain text file and upload it to Airflow UI

B. Set variables without encryption and rely on OS file permissions

C. Write a script that uses airflow variables set --encrypt for each secret

D. Use Airflow connections instead of variables for secrets

Solution

1. Step 1: Understand best practice for multiple encrypted variables

   Using a script automates setting each secret with encryption flag, ensuring safety.

2. Step 2: Evaluate other options

   Uploading plain text or skipping encryption risks exposure; connections are different concept.

3. Final Answer:

   Write a script that uses airflow variables set --encrypt for each secret -> Option C

4. Quick Check:

   Automate encrypted variable setting for multiple secrets [OK]

Hint: Automate with script using --encrypt flag [OK]

Common Mistakes:

• Uploading plain text files
• Ignoring encryption for secrets
• Confusing variables with connections