Let Dag viewers read the audit log of the Dags they can see - #72247
Closed
rjgoyln wants to merge 1 commit into
Closed
Let Dag viewers read the audit log of the Dags they can see#72247rjgoyln wants to merge 1 commit into
rjgoyln wants to merge 1 commit into
Conversation
The audit log tab answers questions a Dag's own users have to answer for themselves -- when the executor killed a task, when a heartbeat timed out -- but under the FAB auth manager only Admin could open it, so debugging one of those needed an administrator. Audit access was narrowed to Admin in apache#37501 because the audit log mixed the Dag-scoped rows together with Connection, Variable and Pool operations, which carry no per-Dag key to authorize on. apache#70759 split those apart in Airflow 3.4.0: they are gated on the separate All Audit Logs resource now, and what is left behind Audit Logs.can_read is the Dag-scoped rows, which both endpoints already narrow to the Dags the caller may read. That split is what makes the grant safe, and this provider still supports the cores that predate it, where those rows come back to anyone holding Audit Logs.can_read. So the grant follows the split rather than the provider version, and stays admin-only on an older Airflow. closes: apache#72238
rjgoyln
force-pushed
the
fix/fab-viewer-dag-audit-log
branch
from
August 29, 2026 08:41
01a823b to
72e56e5
Compare
rjgoyln
marked this pull request as ready for review
August 29, 2026 10:53
Member
|
I do not think this is a good idea. logs might potentially contain information that is sensitive. This is not "nice to have" but decision about that should be taken deliberately and likely on devlist. Let me close it for now, we can always re-open, but if you want to follow this path - raise the discussion on devlist |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Under the FAB auth manager only
Admincan read the audit log, so the events a Dag's own users need in order to debug it — a task killed by the executor, a heartbeat that timed out — are out of their reach.Audit access was narrowed to
Adminin #37501 because the audit log mixed Dag-scoped rows together with Connection, Variable and Pool operations, which carry no per-Dag key to authorize on. #70759 separated the two in Airflow 3.4.0: those rows now sit behindAll Audit Logs, leavingAudit Logs.can_readcovering only the Dag-scoped rows, which both event log endpoints already narrow to the Dags the caller may read.Compatibility
The grant follows that split rather than the provider version: a core without
AccessView.AUDIT_LOGS_ALLstill returns the Dag-less rows to anyone holdingAudit Logs.can_read, so both permissions stay withAdminthere.Known limitation
The split is
dag_id IS NULL, andaction_loggingstampsdag_idfrom query parameters as well as the path:POST /api/v2/connections?dag_id=some_daglands a connection write among the Dag-scoped rows. That was inert while those rows were admin-only; here it makes them readable by every viewer, since a defaultViewerholds globalDags.can_read. It takes an actor who already holds write access to the resource, and the maskers still redact the secrets, so what surfaces is metadata — a connection id, host, login. Narrowing the stamp to path parameters belongs in core, not here.closes: #72238
Was generative AI tooling used to co-author this PR?
Generated-by: Claude Opus 5 (1M context) following the guidelines