Managed Airflow (Gen 3) | Managed Airflow (Gen 2) | Managed Airflow (Legacy Gen 1)
Securing your Managed Airflow environment is crucial for protecting sensitive data and preventing unauthorized access. This page outlines key best practices, including recommendations for network security, Identity and Access Management, encryption, and environment configuration management.
To get more information about security features available in Managed Airflow, see Security overview.
Manage environment configuration and DAGs using version control
Create your environment using Terraform. In this way, you can store environment's configuration as code in a repository. In this way, changes to your environment configuration can be reviewed before they are applied, and you can reduce the number of users who have permissions to change the configuration by assigning roles with less permissions.
In Identity and Access Management, disable direct access to DAGs and environment's configuration to regular users, as detailed in the Identity and Access Management section.
Deploy DAGs in your environment with a CI/CD pipeline, so that DAG code is retrieved from a repository. In this way, DAGs are reviewed and approved before the changes are merged to the version control system. During the review process, approvers make sure that DAGs meet the security criteria established within their teams. The review step is critical to prevent deployment of DAGs that might perform unwanted actions.
Some important security aspects to take into account when reviewing DAGs are:
DAGs that modify the content of the environment's bucket must not modify the code of other DAGs or access sensitive data, unless intended.
DAGs must not make direct queries to the Airflow database, unless intended. A DAG in a Managed Airflow environment has access to all tables in the Airflow database. It is possible to retrieve information from any table, process it, and then store it outside of the Airflow database.