Airflow Config Exposure¶

Description¶

Detects public exposure of Apache Airflow configuration file.

To remediate an Airflow Config Exposure, follow these steps:

Identify and restrict access to the Airflow configuration file (airflow.cfg) to only authorized users.
Ensure that the Airflow metadata database password and other sensitive information are not stored in plain text within the configuration file.
Use environment variables or a secrets backend to manage sensitive information securely.
Regularly audit and rotate credentials and secrets.
Implement file system permissions and access controls to prevent unauthorized reading or modification of the configuration file.
Review and update your Airflow webserver configuration to disable the exposure of sensitive configuration variables via the web interface.
Apply network security measures to limit access to the Airflow webserver and metadata database to trusted networks only.
Keep Airflow and its dependencies up to date with the latest security patches.

Identifier: information_disclosure/airflow_config_exposure

checks:
  information_disclosure/airflow_config_exposure:
    skip: true