GitHub user cookesan added a comment to the discussion: Native Airflow Dags
Level Roles on Airflow 3.2.0
Yes, if you are using the FAB auth manager. DAG-level roles are still
documented for Airflow 3.
The current model is resource/action based. A user can get broad permissions
such as `DAGs.can_read`, or permissions for one DAG via a resource named
`Dag:<dag_id>`, for example `Dag:my_dag.can_read` or `Dag:my_dag.can_edit`.
The usual setup is:
- keep the built-in roles unchanged
- create custom roles as an Admin user, either in the UI or with `airflow roles
create`
- assign those roles to users with the UI or `airflow users add-role`
- grant the role only the DAG resources it should access
You can also put DAG-level access in code with the DAG's `access_control`
argument, but be careful with that path. The docs say `access_control` is
authoritative: setting it on a DAG can overwrite DAG-level permissions stored
in the DB, and `access_control={}` can wipe them for that DAG.
GitHub link:
https://github.com/apache/airflow/discussions/65580#discussioncomment-16657266
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to: [email protected]
