{"id":31026104,"url":"https://github.com/tristanbilot/airflow-rbac-roles-cli","last_synced_at":"2025-10-25T09:34:37.418Z","repository":{"id":113904623,"uuid":"423891689","full_name":"TristanBilot/airflow-rbac-roles-cli","owner":"TristanBilot","description":"A tool to create Airflow RBAC roles with dag-level permissions from cli.","archived":false,"fork":false,"pushed_at":"2023-09-07T06:42:02.000Z","size":11,"stargazers_count":13,"open_issues_count":2,"forks_count":6,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-09-13T18:13:47.279Z","etag":null,"topics":["airflow","cloud-composer","data-engineering","data-science","gcp","permissions","pipeline","rbac-roles"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/TristanBilot.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2021-11-02T15:10:34.000Z","updated_at":"2024-08-19T13:57:34.000Z","dependencies_parsed_at":null,"dependency_job_id":"52278d56-f77d-452d-b0df-66e5aa0c0e47","html_url":"https://github.com/TristanBilot/airflow-rbac-roles-cli","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/TristanBilot/airflow-rbac-roles-cli","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TristanBilot%2Fairflow-rbac-roles-cli","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TristanBilot%2Fairflow-rbac-roles-cli/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TristanBilot%2Fairflow-rbac-roles-cli/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TristanBilot%2Fairflow-rbac-roles-cli/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/TristanBilot","download_url":"https://codeload.github.com/TristanBilot/airflow-rbac-roles-cli/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TristanBilot%2Fairflow-rbac-roles-cli/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":280936400,"owners_count":26416542,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-25T02:00:06.499Z","response_time":81,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["airflow","cloud-composer","data-engineering","data-science","gcp","permissions","pipeline","rbac-roles"],"created_at":"2025-09-13T17:58:29.095Z","updated_at":"2025-10-25T09:34:37.395Z","avatar_url":"https://github.com/TristanBilot.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# airflow-rbac-roles-cli\nAirflow provides a way to manage permissions: RBAC. However, this system is only available from UI. Many use cases such as the implementation of an Airflow orchestrator for multiple projects need to take profit of dag-level permissions in order to only authorize some users to access specific project dags. **Creating roles with dag-level permissions on multiple dags directly from the UI is very error-prone and time-consuming.**\n\nThat's why I created a script which given the **airflow url**, the **dag names** and the **new role name**, will automatically create the role with the needed permissions to access only these dags and not the other dags deployed on Airflow. \n\n\u003e The tool can be used to create roles for multiple projects inside a same Airflow.\n\n## Usage\n```shell\npython3 rbac_roles_cli.py -u airflow_url -r new_role_name -d dag1 dag2\n```\nWill create a role named `new_role_name` on the airflow project at the url `airflow_url` with enough permissions to only manage the dags `dag1` and `dag2`. \n\nNote that the permissions can be edited directly in the code and following the syntax used in the \u003ca href=\"https://github.com/apache/airflow/blob/d1f3d8ec19d3c3b2494fbcd5a1adb5be4d4af03b/airflow/security/permissions.py\"\u003e Airflow code\u003c/a\u003e.\n\n## Compatibility with Cloud Composer\nGCP offers Cloud Composer: a Google-managed Airflow. The script also work with Composer, you only need to add an argument to the command: \u003ca href=\"https://www.daimto.com/how-to-get-a-google-access-token-with-curl/\"\u003e the Google access-token\u003c/a\u003e. This token is used in order to access the Composer page which is protected by a Google authentication page.\n\n```shell\npython3 rbac_roles_cli.py -u airflow_url -r new_role_name -d dag1 dag2 -t access_token\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftristanbilot%2Fairflow-rbac-roles-cli","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftristanbilot%2Fairflow-rbac-roles-cli","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftristanbilot%2Fairflow-rbac-roles-cli/lists"}