Skip to content

Revoking audit_log permission from all users except admin #37501

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
potiuk merged 6 commits into from
Feb 19, 2024
Merged

Revoking audit_log permission from all users except admin #37501

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1059ee3
Revoking audit_log permission from viewer role
amoghrajesh Feb 17, 2024
437285e
moving revoked permissions to USER_PERMISSIONS for other users
amoghrajesh Feb 17, 2024
82e416d
audit logs only on admins
amoghrajesh Feb 17, 2024
fcf1cd5
review comments by Jed
amoghrajesh Feb 19, 2024
c381759
review comments from Jed
amoghrajesh Feb 19, 2024
1cb1958
adding a newsfragment
amoghrajesh Feb 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions airflow/providers/fab/auth_manager/security_manager/override.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,6 @@ class FabAirflowSecurityManagerOverride(AirflowSecurityManagerV2):

# [START security_viewer_perms]
VIEWER_PERMISSIONS = [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_AUDIT_LOG),
(permissions.ACTION_CAN_READ, permissions.RESOURCE_DAG),
(permissions.ACTION_CAN_READ, permissions.RESOURCE_DAG_DEPENDENCIES),
(permissions.ACTION_CAN_READ, permissions.RESOURCE_DAG_CODE),
Expand Down Expand Up @@ -233,7 +232,6 @@ class FabAirflowSecurityManagerOverride(AirflowSecurityManagerV2):
(permissions.ACTION_CAN_ACCESS_MENU, permissions.RESOURCE_DOCS),
(permissions.ACTION_CAN_ACCESS_MENU, permissions.RESOURCE_DOCS_MENU),
(permissions.ACTION_CAN_ACCESS_MENU, permissions.RESOURCE_JOB),
(permissions.ACTION_CAN_ACCESS_MENU, permissions.RESOURCE_AUDIT_LOG),
(permissions.ACTION_CAN_ACCESS_MENU, permissions.RESOURCE_PLUGIN),
(permissions.ACTION_CAN_ACCESS_MENU, permissions.RESOURCE_SLA_MISS),
(permissions.ACTION_CAN_ACCESS_MENU, permissions.RESOURCE_TASK_INSTANCE),
Expand Down Expand Up @@ -281,6 +279,8 @@ class FabAirflowSecurityManagerOverride(AirflowSecurityManagerV2):

# [START security_admin_perms]
ADMIN_PERMISSIONS = [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_AUDIT_LOG),
(permissions.ACTION_CAN_ACCESS_MENU, permissions.RESOURCE_AUDIT_LOG),
(permissions.ACTION_CAN_READ, permissions.RESOURCE_TASK_RESCHEDULE),
(permissions.ACTION_CAN_ACCESS_MENU, permissions.RESOURCE_TASK_RESCHEDULE),
(permissions.ACTION_CAN_READ, permissions.RESOURCE_TRIGGER),
Expand Down
13 changes: 13 additions & 0 deletions docs/apache-airflow/security/security_model.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,12 +106,17 @@ sensitive information accessible through connection configuration.
They also have the ability to create a Webserver Denial of Service
situation and should be trusted not to misuse this capability.

Only admin users have access to audit logs. Unless specified otherwise in any other section below,
other users do not have permissions on audit logs.
Comment thread
amoghrajesh marked this conversation as resolved.
Outdated

Operations users
................

The primary difference between an operator and admin is the ability to manage and grant permissions
to other users - only admins are able to do this. Otherwise assume they have the same access as an admin.

Operations users also do not have permission to access audit logs.

Comment thread
amoghrajesh marked this conversation as resolved.
Connection configuration users
..............................

Expand All @@ -134,6 +139,14 @@ Regular users
They can view and interact with the UI and API. They are able to view and edit DAGs,
task instances, and DAG runs, and view task logs.

Viewer users
............

They can view information related to DAGs, in a read only fashion, task logs, and other relevant details.
This role is suitable for users who require read-only access without the ability to trigger or modify DAGs.

Viewers also do not have permission to access audit logs.
Comment thread
potiuk marked this conversation as resolved.

For more information on the capabilities of authenticated UI users, see :doc:`apache-airflow-providers-fab:auth-manager/access-control`.

Capabilities of DAG Authors
Expand Down