Variable encryption for secrets in Apache Airflow - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable encryption for Airflow variables.

Apache Airflow

from airflow.models import Variable

secret_value = Variable.get('[1]', deserialize_json=True)

Drag options to blanks, or click blank then click option'

Amy_secret

Bmy_variable

Cconfig_value

Dpassword

Attempts:

3 left

💡 Hint

Common Mistakes

Using a variable name that does not exist in Airflow variables.

Not setting deserialize_json=True when the secret is stored as JSON.

The variable name my_secret is used to retrieve the encrypted secret stored in Airflow variables.

2fill in blank

medium

Complete the code to set an encrypted variable in Airflow using the CLI.

Apache Airflow

airflow variables [1] my_secret_key my_secret_value

Drag options to blanks, or click blank then click option'

Adelete

Blist

Cget

Dset

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'get' instead of 'set' to create a variable.

Trying to use 'list' or 'delete' commands to set a variable.

The set command is used to create or update a variable in Airflow, which can be encrypted if encryption is enabled.

3fill in blank

hard

Fix the error in the code to correctly retrieve an encrypted variable as a string.

Apache Airflow

secret = Variable.get('[1]', deserialize_json=[2])

Drag options to blanks, or click blank then click option'

AFalse

BNone

CTrue

D0

Attempts:

3 left

💡 Hint

Common Mistakes

Setting deserialize_json to True when the variable is not JSON.

Passing None or 0 instead of a boolean value.

When retrieving a secret stored as a plain string, deserialize_json should be set to False to avoid errors.

4fill in blank

hard

Fill both blanks to create a variable dictionary comprehension filtering secrets with length greater than 5.

Apache Airflow

secrets = {key: Variable.get(key) for key in Variable.get('[1]') if len(Variable.get(key)) [2] 5}

Drag options to blanks, or click blank then click option'

Aall_keys

B>

C<

Dkeys_list

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong variable name for keys.

Using less than operator instead of greater than.

all_keys is used to get all variable keys, and the condition > filters secrets longer than 5 characters.

5fill in blank

hard

Fill all three blanks to create a dictionary of uppercase keys and their decrypted values where values are not empty.

Apache Airflow

decrypted = { [1]: Variable.get([2]) for [3] in Variable.get('all_keys') if Variable.get([3]) != '' }

Drag options to blanks, or click blank then click option'

Akey.upper()

Bkey

Dkeys

Attempts:

3 left

💡 Hint

Common Mistakes

Using different variable names inconsistently.

Not converting keys to uppercase.

The dictionary uses key.upper() for keys, retrieves values with Variable.get(key), and iterates with key.

Practice

1. What is the main purpose of encrypting variables in Airflow?

easy

A. To keep sensitive data like passwords safe from unauthorized access

B. To speed up the execution of DAGs

C. To reduce the size of variable storage

D. To make variables visible in the Airflow UI

Solution

1. Step 1: Understand variable encryption purpose

   Encryption protects sensitive information by making it unreadable without a key.

2. Step 2: Relate to Airflow variables

   Airflow encrypts variables to keep secrets like passwords safe from unauthorized users.

3. Final Answer:

   To keep sensitive data like passwords safe from unauthorized access -> Option A

4. Quick Check:

   Encryption = Protect secrets [OK]

Hint: Encryption means hiding secrets safely [OK]

Common Mistakes:

• Thinking encryption speeds up DAGs
• Confusing encryption with compression
• Believing encryption makes variables visible

2. Which command correctly sets an encrypted variable named API_KEY with value 12345 in Airflow CLI?

easy

A. airflow variables set --encrypt API_KEY 12345

B. airflow variables set API_KEY --encrypt 12345

C. airflow variables set API_KEY 12345 --encrypt

D. airflow variables set 12345 API_KEY --encrypt

Solution

1. Step 1: Recall Airflow CLI syntax for encrypted variables

   The correct syntax places the --encrypt flag before the variable name and value.

2. Step 2: Match syntax with options

   airflow variables set --encrypt API_KEY 12345 uses airflow variables set --encrypt API_KEY 12345, which is correct.

3. Final Answer:

   airflow variables set --encrypt API_KEY 12345 -> Option A

4. Quick Check:

   Flag before name and value = airflow variables set --encrypt API_KEY 12345 [OK]

Hint: Put --encrypt right after 'set' command [OK]

Common Mistakes:

• Placing --encrypt after variable name or value
• Swapping variable name and value order
• Omitting --encrypt flag

3. Given the following code snippet in an Airflow DAG:

from airflow.models import Variable
secret = Variable.get('MY_SECRET')

What will secret contain if MY_SECRET was set with encryption?

medium

A. The encrypted string stored in Airflow

B. The decrypted original secret value

C. An error because encrypted variables cannot be read

D. None, because encrypted variables are hidden

Solution

1. Step 1: Understand Variable.get behavior with encrypted variables

   Airflow automatically decrypts encrypted variables when accessed via Variable.get.

2. Step 2: Determine what secret holds

   It holds the original decrypted secret value, not the encrypted string or None.

3. Final Answer:

   The decrypted original secret value -> Option B

4. Quick Check:

   Variable.get decrypts automatically [OK]

Hint: Variable.get returns decrypted value automatically [OK]

Common Mistakes:

• Expecting encrypted string instead of decrypted
• Assuming Variable.get raises error for encrypted vars
• Thinking encrypted vars are hidden and return None

4. You tried to set an encrypted variable with this command:
airflow variables set API_SECRET 98765 --encrypt
But the variable is not encrypted. What is the likely mistake?

medium

A. The value must be base64 encoded before setting

B. The variable name cannot contain underscores

C. You must restart Airflow for encryption to work

D. The --encrypt flag should come before the variable name and value

Solution

1. Step 1: Check correct placement of --encrypt flag

   The flag must be placed immediately after set, before variable name and value.

2. Step 2: Analyze the command given

   The flag is placed after value, so encryption is not applied.

3. Final Answer:

   The --encrypt flag should come before the variable name and value -> Option D

4. Quick Check:

   Flag position matters for encryption [OK]

Hint: Place --encrypt right after 'set' command [OK]

Common Mistakes:

• Putting --encrypt after value
• Restarting Airflow unnecessarily
• Encoding value manually before setting

5. You want to securely store multiple secrets as Airflow variables encrypted at once. Which approach is best?

hard

A. Store all secrets in a plain text file and upload it to Airflow UI

B. Set variables without encryption and rely on OS file permissions

C. Write a script that uses airflow variables set --encrypt for each secret

D. Use Airflow connections instead of variables for secrets

Solution

1. Step 1: Understand best practice for multiple encrypted variables

   Using a script automates setting each secret with encryption flag, ensuring safety.

2. Step 2: Evaluate other options

   Uploading plain text or skipping encryption risks exposure; connections are different concept.

3. Final Answer:

   Write a script that uses airflow variables set --encrypt for each secret -> Option C

4. Quick Check:

   Automate encrypted variable setting for multiple secrets [OK]

Hint: Automate with script using --encrypt flag [OK]

Common Mistakes:

• Uploading plain text files
• Ignoring encryption for secrets
• Confusing variables with connections