Deprecation Notice for airflow.security.permissions
Since the release of Airflow 3, the Flask AppBuilder (AKA “FAB”) provider is
no longer a core Airflow dependency.
However, some modules specifically designed for Flask AppBuilder (FAB) auth manager remain in the core Airflow distribution as a
backwards-compatible convenience for Airflow users. One such module which remains in the core distribution for backwards compatibility purposes is airflow.security.permissions
If your deployment depends on airflow.security.permissions for any custom role definitions, or for any custom Auth Manager logic –
regardless of whether you use the FAB Auth Manager or some other Auth Manager – you should transition
to the new authorization standard definitions for resources and actions.
The deprecated airflow.security.permissions will be removed in Airflow 4.
Does this Deprecation Affect My Airflow System?
Generally speaking, this deprecation warning applies to any Airflow system in which either of the following is true:
The Airflow deployment relies on
airflow.security.permissionsto define custom RBAC roles.The Airflow deployment has other custom logic which relies on
airflow.security.permissions, including any custom Auth manager dependencies.
However, if you rely on the unmodified Flask AppBuilder (FAB) auth manager and you do not use any custom role definitions, then the rest of this doc does not apply to you.
Similarly, if you rely on the Simple auth manager or any of the other provider Auth Managers, and have no custom code using airflow.security.permissions, then the rest of this doc does not apply to you.
Note
Each customized Airflow RBAC setup differs on a case-by-case basis. As such, this doc can only provide general guidance for the transition to the new Airflow authorization standards, without being overly prescriptive.
Migrating DAG.access_control
Unlike the components above, DAG.access_control has no drop-in replacement. It was an input to the
FAB auth manager rather than an authorization mechanism of its own: at parse time its contents were
expanded into that manager’s permission tables, and authorization then read those tables rather than
the Dag argument.
Warning
Airflow only reads DAG.access_control when the configured auth manager is the
Flask AppBuilder (FAB) auth manager. Under any other auth manager the argument is
parsed and serialized but never consulted, so it neither grants nor denies access. A deployment that
moves off the FAB auth manager and leaves access_control on its Dags stops enforcing those grants,
and does so without raising an error.
To migrate, move the grants into the policy source your auth manager consults. The Auth manager guide covers how a custom auth manager should express Dag-level access.