Variable encryption for secrets in Apache Airflow - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of variable encryption in Airflow?

Variable encryption in Airflow protects sensitive information like passwords or API keys by storing them in an encrypted form, so only authorized users or systems can read them.

intermediate

Which Airflow component is responsible for encrypting variables?

The Airflow metadata database stores variables, and encryption is handled by the Fernet key configured in Airflow's settings to encrypt and decrypt variable values.

beginner

How do you enable variable encryption in Airflow?

Set the 'fernet_key' in the airflow.cfg configuration file with a valid Fernet key. Airflow will then use this key to encrypt and decrypt variables automatically.

intermediate

What happens if the Fernet key is lost or changed in Airflow?

If the Fernet key is lost or changed, Airflow cannot decrypt previously encrypted variables, causing secret data to become inaccessible until the original key is restored.

beginner

Why is it better to use Airflow's variable encryption instead of storing secrets in plain text?

Encrypting variables prevents unauthorized users from reading sensitive data directly from the database or configuration files, reducing the risk of data leaks and improving security.

What configuration setting enables variable encryption in Airflow?

A fernet_key

B secret_key

C encryption_enabled

D variable_encryption

The 'fernet_key' setting in airflow.cfg is used to enable encryption and decryption of variables.

What is the main risk if the Fernet key is lost?

A Airflow stops working

B Variables become readable by anyone

C Variables cannot be decrypted

D Variables get deleted automatically

Without the original Fernet key, Airflow cannot decrypt encrypted variables, making secrets inaccessible.

Where are Airflow variables stored?

A In the metadata database

B In the DAG files

C In environment variables

D In the Airflow logs

Airflow variables are stored in the metadata database, where encryption is applied if configured.

Which library does Airflow use for variable encryption?

A Hashlib

B PyCrypto

C OpenSSL

D Fernet from cryptography

Airflow uses Fernet encryption from the cryptography library to encrypt variables.

Why should secrets be encrypted rather than stored in plain text?

A To improve performance

B To prevent unauthorized access

C To reduce storage size

D To make variables easier to edit

Encryption protects secrets from unauthorized users by making the data unreadable without the key.

Explain how Airflow uses the Fernet key to secure variables.

Think about how a secret key locks and unlocks information.

Describe the consequences of losing the Fernet key in Airflow.

What happens if you lose the key to a locked box?