potiuk commented on code in PR #65496:
URL: https://github.com/apache/airflow/pull/65496#discussion_r3107862595
##########
airflow-core/docs/security/security_model.rst:
##########
@@ -153,15 +153,70 @@ Those users should be highly trusted not to misuse this
capability.
case of the sensitive credentials stored in configuration extras. Airflow 3
and later versions mask these sensitive credentials
at the API level and do not return them in clear text.
-About Sensitive information
-...........................
-
-Sensitive information consists of connection details, variables, and
configuration. In versions later than Airflow 3.0
-sensitive information will not be exposed to users via API, UI, and
``airflowctl``.
-However, ``task-sdk`` still provides access to sensitive information (e.g.,
Use SDK API Client to get
-Variables with task-specific ``JWT`` token). Local CLI will only return keys
except when using ``--show_values``.
-Sensitive information has been masked in logs, UI, and API outputs. In case of
Dag author expose sensitive
-information in other way (e.g., via environment variables), those values will
not be masked.
+.. _sensitive-data-exposure-policy:
+
+Sensitive Data Exposure Policy
+...............................
+
+Airflow treats the following as **sensitive information** that must not be
exposed to users
+without appropriate authorization:
+
+* **Connections**: credentials, passwords, tokens, and connection parameters
stored in Airflow's
+ connection store or a configured secrets backend.
+* **Variables**: values stored in Airflow Variables (keys are not sensitive,
but values may be).
+* **Configuration**: configuration options marked ``sensitive: true`` in
Airflow's configuration,
+ such as the Fernet key, database connection string, and JWT signing key.
+
+**Where sensitive data is protected**
+
+Starting with Airflow 3.0, sensitive information is masked or withheld at the
API level so that
+it is never returned in clear text to authenticated UI users, regardless of
their role:
+
+* **REST API**: Sensitive fields (such as connection passwords and variable
values) are not
+ returned by the API. The API returns a masked placeholder instead.
+* **UI**: The Airflow UI relies on the API and therefore also never displays
sensitive values in
+ clear text. This is a change from Airflow 2, where connection extras were
visible in the UI
+ for users with connection configuration permissions.
+* **``airflowctl`` CLI**: The CLI uses the API and follows the same masking
rules. By default,
+ only keys are displayed for variables; values are not shown.
+
+.. note::
+
+ Before Airflow 3, the **Connection configuration users** role had read
access to sensitive
+ credential values. This was changed in Airflow 3 to prevent accidental
exposure of credentials.
+ In Airflow 2, sensitive values stored in connection extras were visible in
plain text in the UI
+ and retrievable via the API for users with the appropriate role.
+
+**Where sensitive data remains accessible (by design)**
+
+Some surfaces still provide access to sensitive data — this is intentional and
required for
+Airflow's task execution model to function:
+
+* **Task SDK (Execution API)**: Worker tasks can retrieve connection details
and variable values
+ via the Execution API using the short-lived, task-scoped JWT token issued to
each task. This is
+ required so that tasks can authenticate with external systems. The token is
scoped to the
+ specific task instance and expires after a short period (default: 10
minutes).
+* **``airflowctl`` CLI with ``--show-values``**: Operators and Deployment
Managers may pass the
Review Comment:
`--show-values` is for `airflow` CLI not `airflow ctl`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
