Skip to content

Latest commit

 

History

History
32 lines (23 loc) · 1.38 KB

secure-connections.rst

File metadata and controls

32 lines (23 loc) · 1.38 KB

Securing Connections

By default, Airflow will save the passwords for the connection in plain text within the metadata database. The crypto package is highly recommended during installation. The crypto package does require that your operating system have libffi-dev installed.

If crypto package was not installed initially, you can still enable encryption for connections by following steps below:

  1. Install crypto package pip install apache-airflow[crypto]
  2. Generate fernet_key, using this code snippet below. fernet_key must be a base64-encoded 32-byte key.
from cryptography.fernet import Fernet
fernet_key= Fernet.generate_key()
print(fernet_key.decode()) # your fernet_key, keep it in secured place!

3. Replace airflow.cfg fernet_key value with the one from step 2. Alternatively, you can store your fernet_key in OS environment variable. You do not need to change airflow.cfg in this case as Airflow will use environment variable over the value in airflow.cfg:

# Note the double underscores
export AIRFLOW__CORE__FERNET_KEY=your_fernet_key
  1. Restart Airflow webserver.
  2. For existing connections (the ones that you had defined before installing airflow[crypto] and creating a Fernet key), you need to open each connection in the connection admin UI, re-type the password, and save it.