CIS Apache Airflow Benchmark

This recommendation verifies that Airflow is running the latest stable version on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify Airflow version
airflow version
# Check if running as dedicated user
ps -eo user,pid,comm | grep airflow

# Upgrade Airflow to latest stable
pip install --upgrade apache-airflow
# Run as dedicated user:
useradd -r -s /usr/sbin/nologin airflow
chown -R airflow:airflow /opt/airflow

This setting ensures that Airflow configuration file permissions are restricted on the Apache Airflow workflow orchestration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apache Airflow workflow orchestration platform is essential for defense in depth.

# Check Airflow home permissions
stat -c '%a %U %G' $AIRFLOW_HOME
stat -c '%a %U %G' $AIRFLOW_HOME/airflow.cfg
stat -c '%a %U %G' $AIRFLOW_HOME/dags/

# Restrict Airflow configuration permissions
chmod 700 $AIRFLOW_HOME
chmod 600 $AIRFLOW_HOME/airflow.cfg
chmod 750 $AIRFLOW_HOME/dags/
chown -R airflow:airflow $AIRFLOW_HOME

This recommendation verifies that production authentication backend is configured on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check web server authentication backend
grep 'auth_backend\|auth_type' $AIRFLOW_HOME/airflow.cfg
grep 'AIRFLOW__WEBSERVER__AUTH_BACKEND' /etc/environment 2>/dev/null

# Configure authentication backend (FAB with LDAP/OAuth)
# In airflow.cfg [webserver]:
# auth_backend = airflow.providers.fab.auth_manager.fab_auth_manager
# In webserver_config.py:
# AUTH_TYPE = AUTH_OAUTH
# or AUTH_TYPE = AUTH_LDAP
# Disable default password auth in production

This recommendation verifies that RBAC is enabled with appropriate roles on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check RBAC settings
grep -E 'rbac|auth_role' $AIRFLOW_HOME/airflow.cfg
airflow users list

# Configure RBAC roles
# In airflow.cfg [webserver]:
# rbac = True
# auth_role_public = Public
# auth_role_admin = Admin
# Create users with appropriate roles:
airflow users create --username admin --role Admin --email admin@example.com
airflow users create --username viewer --role Viewer --email viewer@example.com

This recommendation verifies that HTTPS is configured for the web server on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check web server SSL configuration
grep -E 'web_server_ssl|ssl_cert|ssl_key' $AIRFLOW_HOME/airflow.cfg

# Enable HTTPS for web server
# In airflow.cfg [webserver]:
# web_server_ssl_cert = /etc/airflow/ssl/cert.pem
# web_server_ssl_key = /etc/airflow/ssl/key.pem
# base_url = https://airflow.example.com

This recommendation verifies that Fernet key is configured for connection encryption on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Fernet key configuration
grep 'fernet_key' $AIRFLOW_HOME/airflow.cfg
python3 -c "from cryptography.fernet import Fernet; print('Fernet available')"

# Configure Fernet key for connection encryption
python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# In airflow.cfg [core]:
# fernet_key = <GENERATED_KEY>
# Or via environment variable:
# export AIRFLOW__CORE__FERNET_KEY=<GENERATED_KEY>

This recommendation verifies that remote logging is configured for task logs on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging configuration
grep -E 'base_log_folder|remote_logging|remote_log_conn_id' $AIRFLOW_HOME/airflow.cfg

# Configure remote logging
# In airflow.cfg [logging]:
# remote_logging = True
# remote_log_conn_id = aws_default
# remote_base_log_folder = s3://airflow-logs/
# encrypt_s3_logs = True
# Or for local logging:
# base_log_folder = /var/log/airflow
# logging_level = INFO

This recommendation verifies that audit logging is enabled for web UI actions on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit log settings
grep -E 'audit|action_logger' $AIRFLOW_HOME/airflow.cfg

# Enable action logging
# In airflow.cfg [webserver]:
# audit_view_excluded_events =
# audit_view_included_events = all
# Configure log rotation:
cat > /etc/logrotate.d/airflow << 'EOF'
/var/log/airflow/*.log {
    daily
    rotate 30
    compress
    missingok
}
EOF

This recommendation verifies that production database backend is used with TLS on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check database backend
grep 'sql_alchemy_conn' $AIRFLOW_HOME/airflow.cfg
airflow db check

# Configure production database backend
# In airflow.cfg [database]:
# sql_alchemy_conn = postgresql+psycopg2://airflow:PASS@db:5432/airflow?sslmode=verify-full
# Do NOT use SQLite in production
# sql_alchemy_pool_size = 5
# sql_alchemy_max_overflow = 10

This recommendation verifies that production-grade executor is configured on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check executor type
grep 'executor' $AIRFLOW_HOME/airflow.cfg | head -3

# Use production-grade executor
# In airflow.cfg [core]:
# executor = CeleryExecutor
# Or:
# executor = KubernetesExecutor
# Do NOT use SequentialExecutor or LocalExecutor in production

This setting ensures that DAG discovery and access are restricted on the Apache Airflow workflow orchestration platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Apache Airflow workflow orchestration platform is essential for defense in depth.

# Verify DAG access control
grep -E 'dag_default_view|hide_paused' $AIRFLOW_HOME/airflow.cfg
airflow dags list | wc -l

# Restrict DAG access
# In airflow.cfg [webserver]:
# expose_config = False
# dag_default_view = grid
# In airflow.cfg [core]:
# dag_discovery_safe_mode = True
# dags_are_paused_at_creation = True

This recommendation verifies that API authentication is enabled on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check API authentication
grep -E 'auth_backends|api' $AIRFLOW_HOME/airflow.cfg | head -5

# Configure API authentication
# In airflow.cfg [api]:
# auth_backends = airflow.api.auth.backend.session
# Or for token-based:
# auth_backends = airflow.providers.fab.auth_manager.api.auth.backend.token_auth
# Disable default deny_all in production as needed

This recommendation verifies that metadata database cleanup is scheduled on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check database cleanup
airflow db check
airflow db shell -c "SELECT count(*) FROM dag_run WHERE state='success' AND execution_date < NOW() - INTERVAL '90 days';" 2>/dev/null

# Configure metadata database cleanup
airflow db clean --clean-before-timestamp '2024-01-01' --yes
# Schedule regular cleanup via DAG or cron:
# 0 2 * * 0 airflow db clean --clean-before-timestamp "$(date -d '-90 days' +%%Y-%%m-%%d)" --yes

This recommendation verifies that external secrets backend is configured on the Apache Airflow workflow orchestration platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Apache Airflow workflow orchestration platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check secret backend configuration
grep 'backend' $AIRFLOW_HOME/airflow.cfg | grep -i secret

# Configure secrets backend
# In airflow.cfg [secrets]:
# backend = airflow.providers.hashicorp.secrets.vault.VaultBackend
# backend_kwargs = {"connections_path": "connections", "variables_path": "variables", "url": "https://vault:8200"}
# This avoids storing secrets in the metadata database