Why access control protects sensitive pipelines in Apache Airflow - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define the Airflow role that allows viewing DAGs but not editing them.

Apache Airflow

role = BaseRole(name='Viewer', permissions=[1])

Drag options to blanks, or click blank then click option'

A['can_read']

B['can_edit']

C['can_delete']

D['can_create']

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing 'can_edit' or 'can_delete' instead of 'can_read'.

The 'Viewer' role should have 'can_read' permission to view DAGs without editing rights.

2fill in blank

medium

Complete the code to assign the 'Admin' role to a user in Airflow.

Apache Airflow

user.roles.append([1])

Drag options to blanks, or click blank then click option'

A'Operator'

B'Admin'

C'Viewer'

D'User'

Attempts:

3 left

💡 Hint

Common Mistakes

Assigning 'Viewer' or 'Operator' instead of 'Admin'.

Assigning the 'Admin' role gives the user full access to manage pipelines.

3fill in blank

hard

Fix the error in the code to restrict DAG access to only authorized users.

Apache Airflow

dag = DAG('sensitive_data', access_control=[1])

Drag options to blanks, or click blank then click option'

A{'User': {'can_read'}}

B['Admin', 'User']

CNone

D{'Admin': {'can_read', 'can_edit'}}

Attempts:

3 left

💡 Hint

Common Mistakes

Using a list instead of a dictionary for access_control.

Access control must be a dictionary mapping roles to permission sets, like {'Admin': {'can_read', 'can_edit'}}.

4fill in blank

hard

Fill both blanks to create a policy that allows only Admins to trigger DAG runs and view logs.

Apache Airflow

access_policy = [1]: {'can_trigger_dag', [2]

Drag options to blanks, or click blank then click option'

A'Admin'

B'can_view_logs'

C'User'

D'can_edit'

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'User' role or wrong permission names.

The policy grants 'Admin' role permissions to 'can_trigger_dag' and 'can_view_logs'.

5fill in blank

hard

Fill all three blanks to define a secure DAG with restricted access and schedule.

Apache Airflow

dag = DAG('[1]', schedule_interval=[2], access_control=[3])

Drag options to blanks, or click blank then click option'

A'secure_pipeline'

B'@daily'

C{'Admin': {'can_read', 'can_edit'}}

D'@hourly'

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong schedule strings or access control formats.

The DAG named 'secure_pipeline' runs daily and restricts access to Admins with read and edit permissions.