Pada 15 September 2026, semua lingkungan Cloud Composer 1 dan Cloud Composer 2 versi 2.0.x akan mencapai akhir masa pakainya yang direncanakan, dan Anda tidak akan dapat menggunakannya. Sebaiknya rencanakan migrasi ke Cloud Composer 3.
Mengamankan lingkungan Cloud Composer sangat penting untuk melindungi data sensitif dan mencegah akses tidak sah. Halaman ini menguraikan praktik terbaik
utama, termasuk rekomendasi untuk keamanan jaringan, Identity and Access Management,
enkripsi, dan pengelolaan konfigurasi lingkungan.
Untuk mendapatkan informasi selengkapnya tentang fitur keamanan yang tersedia di
Cloud Composer, lihat Ringkasan keamanan.
Mengelola konfigurasi lingkungan dan DAG menggunakan kontrol versi
Gambar 1. Contoh pipeline CI/CD Airflow (klik untuk memperbesar)
Buat lingkungan Anda menggunakan Terraform.
Dengan cara ini, Anda dapat menyimpan konfigurasi lingkungan sebagai kode dalam
repositori. Dengan cara ini, perubahan pada konfigurasi lingkungan dapat
ditinjau sebelum diterapkan, dan Anda dapat mengurangi jumlah pengguna
yang memiliki izin untuk mengubah konfigurasi dengan menetapkan peran dengan
izin yang lebih sedikit.
Di Identity and Access Management, nonaktifkan akses langsung ke DAG dan konfigurasi lingkungan kepada pengguna reguler, seperti yang dijelaskan di bagian Identity and Access Management.
Deploy DAG di lingkungan Anda dengan pipeline CI/CD,
sehingga kode DAG diambil dari repositori. Dengan cara ini, DAG akan ditinjau dan disetujui sebelum perubahan digabungkan ke sistem kontrol versi. Selama proses peninjauan, pemberi persetujuan memastikan bahwa DAG memenuhi
kriteria keamanan yang ditetapkan dalam tim mereka. Langkah peninjauan sangat penting untuk mencegah deployment DAG yang mungkin melakukan tindakan yang tidak diinginkan.
Beberapa aspek keamanan penting yang perlu dipertimbangkan saat meninjau DAG adalah:
DAG yang mengubah konten bucket lingkungan tidak boleh mengubah
kode DAG lain atau mengakses data sensitif, kecuali jika dimaksudkan.
DAG tidak boleh membuat kueri langsung ke database Airflow, kecuali jika
diinginkan. DAG di lingkungan Cloud Composer memiliki akses ke semua tabel di database Airflow. Anda dapat mengambil informasi dari tabel mana pun, memprosesnya, lalu menyimpannya di luar database Airflow.
Keamanan jaringan
Gunakan Lingkungan IP pribadi sehingga komponen Airflow dalam
yang menjalankan cluster lingkungan Anda tidak diberi alamat IP publik
dan hanya berkomunikasi melalui jaringan internal Google.
Tinjau aturan firewall umum di project Anda dan di jaringan VPC tempat lingkungan Anda berada. Bergantung pada cara Anda mengonfigurasinya,
komponen Airflow di lingkungan Anda, seperti pekerja Airflow yang menjalankan
DAG, dapat mengakses internet.
Identity and Access Management
Mengisolasi izin.
Buat akun layanan lingkungan
dan gunakan akun layanan yang berbeda untuk lingkungan yang berbeda. Tetapkan ke akun layanan ini hanya izin yang benar-benar diperlukan untuk mengoperasikan lingkungan ini dan melakukan operasi yang ditentukan dalam DAG Airflow yang dijalankannya.
Hindari penggunaan akun layanan dengan izin yang luas. Meskipun
Anda dapat membuat lingkungan yang menggunakan akun dengan izin
yang luas, seperti yang diberikan oleh peran dasar Editor, hal ini
akan menimbulkan risiko DAG menggunakan izin yang lebih luas dari yang diinginkan.
Jangan mengandalkan akun layanan default layanan Google yang digunakan oleh Cloud Composer. Sering kali tidak mungkin untuk mengurangi izin
yang tersedia untuk akun layanan ini tanpa memengaruhi layanan Google
lainnya dalam project Anda.
Patuhi prinsip hak istimewa terendah. Hanya berikan izin minimum yang diperlukan kepada pengguna. Misalnya,
tetapkan peran IAM, sehingga hanya
administrator yang dapat mengakses bucket lingkungan
dan cluster lingkungan,
dan akses langsung dinonaktifkan untuk pengguna reguler. Misalnya, peran
Pengguna Composer hanya memungkinkan akses ke UI DAG dan UI Airflow.
Terapkan Kontrol Akses UI Airflow, yang memungkinkan pengurangan visibilitas di UI Airflow dan UI DAG berdasarkan peran Airflow pengguna, dan dapat digunakan untuk menetapkan izin tingkat DAG untuk setiap DAG.
Tinjau secara rutin. Lakukan audit izin dan peran IAM secara rutin untuk mengidentifikasi dan menghapus hak istimewa yang berlebihan atau tidak digunakan.
Berhati-hatilah saat meneruskan dan menyimpan data sensitif:
Berhati-hatilah saat meneruskan penyimpanan data sensitif seperti informasi
identitas pribadi atau sandi. Jika diperlukan,
gunakan Secret Manager untuk
menyimpan koneksi Airflow dan secret Airflow, kunci API,
sandi, dan sertifikat dengan aman. Jangan simpan informasi ini dalam DAG atau variabel lingkungan Anda.
Berikan izin IAM ke bucket lingkungan hanya kepada pengguna tepercaya. Gunakan izin per objek, jika memungkinkan.
Pertimbangan keamanan untuk akun layanan lingkungan
mencantumkan beberapa cara pengguna dengan akses ke bucket
lingkungan dapat melakukan tindakan atas nama akun layanan
lingkungan.
Pastikan Anda memahami
data yang disimpan dalam snapshot dan berikan
izin untuk membuat snapshot lingkungan dan mengakses bucket tempat
data disimpan hanya kepada pengguna tepercaya.
Semua antarmuka eksternal Cloud Composer menggunakan enkripsi secara default. Saat terhubung ke produk dan layanan eksternal, pastikan
Anda menggunakan komunikasi terenkripsi (SSL/TLS).
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-26 UTC."],[[["\u003cp\u003eSecuring a Cloud Composer environment involves implementing best practices for network security, Identity and Access Management (IAM), encryption, and environment configuration management.\u003c/p\u003e\n"],["\u003cp\u003eManaging environment configurations and DAGs using version control and CI/CD pipelines is crucial for ensuring code review and preventing unauthorized changes to the environment.\u003c/p\u003e\n"],["\u003cp\u003eUtilizing Private IP environments, implementing strict firewall rules, and configuring connectivity to Google APIs through the \u003ccode\u003eprivate.googleapis.com\u003c/code\u003e domain are vital for network security.\u003c/p\u003e\n"],["\u003cp\u003eIsolating permissions through dedicated service accounts and adhering to the principle of least privilege are key aspects of effective Identity and Access Management.\u003c/p\u003e\n"],["\u003cp\u003eSensitive data should be managed securely using Secret Manager, avoiding storage in DAGs or environment variables, and limiting access to environment buckets and snapshots to trusted users.\u003c/p\u003e\n"]]],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/security-practices \"View this page for Cloud Composer 3\") \\| [Cloud Composer 2](/composer/docs/composer-3/security-practices \"View this page for Cloud Composer 2\") \\| **Cloud Composer 1**\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nSecuring your Cloud Composer environment is crucial for protecting\nsensitive data and preventing unauthorized access. This page outlines key best\npractices, including recommendations for network security, Identity and Access Management,\nencryption, and environment configuration management.\n\nTo get more information about security features available in\nCloud Composer, see [Security overview](/composer/docs/composer-1/composer-security-overview).\n\nManage environment configuration and DAGs using version control [](/static/composer/docs/images/composer-airflow-secure-cicd.svg) **Figure 1.** An example of an Airflow CI/CD pipeline (click to enlarge)\n\n- [Create your environment using Terraform](/composer/docs/composer-1/terraform-create-environments).\n In this way, you can store environment's configuration as code in a\n repository. In this way, changes to your environment configuration can be\n reviewed before they are applied, and you can reduce the number of users\n who have permissions to change the configuration by assigning roles with\n less permissions.\n\n- In Identity and Access Management, disable direct access to DAGs and environment's\n configuration to regular users, as detailed in the\n [Identity and Access Management](#iam-security) section.\n\n- [Deploy DAGs in your environment with a CI/CD pipeline](/composer/docs/composer-1/dag-cicd-github),\n so that DAG code is retrieved from a repository. In this way, DAGs are\n reviewed and approved before the changes are merged to the version control\n system. During the review process, approvers make sure that DAGs meet the\n security criteria established within their teams. The review step is\n critical to prevent deployment of DAGs that might perform unwanted actions.\n\n Some important security aspects to take into account when reviewing DAGs\n are:\n - DAGs that modify the content of the environment's bucket must not modify\n the code of other DAGs or access sensitive data, unless intended.\n\n - DAGs must not make direct queries to the Airflow database, unless\n intended. A DAG in a Cloud Composer environment has\n access to all tables in the Airflow database. It is possible to retrieve\n information from any table, process it, and then store it outside of the\n Airflow database.\n\nNetwork security\n\n\u003cbr /\u003e\n\n- Use [Private IP environments](/composer/docs/composer-1/configure-private-ip) so that Airflow components in\n that run your environment's cluster are not assigned public IP addresses\n and communicate only over Google's internal network.\n\n- [Implement strict firewall rules](/composer/docs/composer-1/configure-private-ip#private-ip-firewall-rules) to control\n traffic to and from your environment's cluster.\n\n- [Configure connectivity to Google APIs and services](/composer/docs/composer-1/configure-private-ip#connectivity-domains)\n through the `private.googleapis.com` domain so that your environment\n accesses Google APIs and services through IP addresses only routable from\n within Google Cloud.\n\n- Review the general firewall rules in your project and in the VPC network\n where your environment is located. Depending on the way you configure them,\n Airflow components of your environment, such as Airflow workers that run\n your DAGs, might access the internet.\n\nIdentity and Access Management\n\n- Isolate permissions.\n [Create environment service accounts](/composer/docs/composer-1/access-control#service-account)\n and use different service accounts for different environments. Assign to\n these service accounts only permissions that are strictly necessary to\n operate these environments and perform operations defined in Airflow DAGs\n that they run.\n\n- Avoid using service accounts with broad permissions. While it\n is possible to create an environment that uses an account with broad\n permissions, such as those granted by the **Editor** basic role, this\n creates a risk of DAGs using broader permissions than intended.\n\n- Don't rely on default service accounts of Google services used by\n Cloud Composer. It is often impossible to reduce permissions\n available to these service accounts without also affecting other Google\n services in your project.\n\n- Make sure that you are familiar with\n [security considerations for environment's service accounts](/composer/docs/composer-1/access-control#service-account-security)\n and understand how this account interacts with permissions and roles that\n you grant to individual users in your project.\n\n- Adhere to the principle of least privilege. Grant only the minimum necessary\n permissions to users. For example,\n [assign IAM roles](/composer/docs/composer-1/access-control#user-account), so that only\n administrators can access the environment's bucket\n\n and the environment's cluster\n ,\n and direct access is disabled for regular users. For example, the\n **Composer User** role enables access only to DAG UI and Airflow UI.\n\n- Enforce [Airflow UI Access Control](/composer/docs/composer-1/airflow-rbac), which allows to reduce\n visibility in Airflow UI and DAG UI based on user's Airflow role, and can be\n used to assign DAG-level permissions for individual DAGs.\n\n- Review regularly. Regularly audit IAM permissions and roles\n to identify and remove any excessive or unused privileges.\n\n- Beware of passing and storing sensitive data:\n\n - Exercise caution when passing storing sensitive data like personally\n identifiable information or passwords. Where required,\n [use Secret Manager](/composer/docs/composer-1/configure-secret-manager) to\n securely store Airflow connections and Airflow secrets, API keys,\n passwords, and certificates. Don't store this information in your DAGs\n or environment variables.\n\n - Grant IAM permissions to the environment's bucket only\n to trusted users. Use per-object permissions, if possible.\n [Security considerations for environment's service accounts](/composer/docs/composer-1/access-control#service-account-security)\n list several ways in which users with access to the environment's\n bucket can perform actions on behalf of the environment's service\n account.\n\n - Make sure that you are familiar with\n [what data is stored in the snapshots](/composer/docs/composer-1/save-load-snapshots) and provide\n permissions to create environment snapshots and access the bucket where\n they are stored only to trusted users.\n\n - All Cloud Composer's external interfaces use encryption by\n default. When connecting to external products and services, make sure\n that you use encrypted communication (SSL/TLS).\n\nWhat's next\n\n- [Security overview](/composer/docs/composer-1/composer-security-overview)\n- [Access control with IAM](/composer/docs/composer-1/access-control)\n- [Airflow UI Access Control](/composer/docs/composer-1/airflow-rbac)\n- [Airflow summit presentation about DAG security](https://www.youtube.com/watch?v=QhnItssm4yU)"]]
