[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[[["\u003cp\u003eCloud Composer 3 offers default security features like encryption at rest, uniform bucket-level access, and various user permission management options, including IAM roles, Airflow UI access control, and Domain Restricted Sharing.\u003c/p\u003e\n"],["\u003cp\u003eAdvanced security features in Cloud Composer 3 include Customer Managed Encryption Keys (CMEK), VPC Service Controls support to reduce data exfiltration risks, and web server network access control levels.\u003c/p\u003e\n"],["\u003cp\u003ePrivate IP environments in Cloud Composer 3 provide increased security by isolating Airflow components from the public internet, with options to configure internet access through the VPC network.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer 3 environments use Shielded VMs, enhancing security by defending against rootkits and bootkits.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer 3 is compliant with multiple industry standards, including HIPAA, PCI DSS, ISO/IEC, SOC, NIST, and FedRamp, ensuring robust security and data protection.\u003c/p\u003e\n"]]],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n**Cloud Composer 3** \\| [Cloud Composer 2](/composer/docs/composer-2/composer-security-overview \"View this page for Cloud Composer 2\") \\| [Cloud Composer 1](/composer/docs/composer-1/composer-security-overview \"View this page for Cloud Composer 1\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nCloud Composer offers a handful of security features and\ncompliances that are beneficial for enterprise companies with stricter\nsecurity requirements.\n\nThese three sections present information about Cloud Composer\nsecurity features:\n\n- [**Basic security features**](#basic). Describes features that are available in Cloud Composer environments by default.\n- [**Advanced security features**](#advanced). Describes features which you can use to modify Cloud Composer to your security requirements.\n- [**Compliance to standards**](#standards). Provides a list of standards that Cloud Composer is compliant with.\n\nBasic security features\n\nThis section lists security-related features provided by default for each\nCloud Composer environment.\n\nEncryption at rest\n\nCloud Composer utilizes\n[encryption at rest in Google Cloud](/security/encryption/default-encryption).\n\nCloud Composer stores data in different services. For example,\nthe Airflow Metadata DB uses Cloud SQL database, DAGs are stored in\nCloud Storage buckets.\n\nBy default, data is encrypted using Google-owned and Google-managed encryption keys.\n\nIf you prefer, you can configure Cloud Composer environments to be\nencrypted with [customer-managed encryption keys](#cmek).\n\nUniform bucket-level access\n\n[Uniform bucket-level access](/storage/docs/uniform-bucket-level-access)\nallows you to uniformly control access to your Cloud Storage\nresources. This mechanism also applies to your environment's bucket, which\nstores your DAGs and plugins.\n\nUser permissions\n\nCloud Composer has several features for managing user permissions:\n\n- **IAM roles and permissions**. Cloud Composer\n environments in a Google Cloud project can be accessed only by users\n whose accounts are added to IAM of the project.\n\n- **Cloud Composer-specific roles and permissions** . You\n [assign these roles and permissions](/composer/docs/composer-3/access-control)\n to user accounts in your project. Each role defines the types of\n operations that a user account can perform on Cloud Composer\n environments in your project.\n\n- **Airflow UI Access Control** . Users in your project\n [can have different access levels in the Airflow UI](/composer/docs/composer-3/airflow-rbac).\n This mechanism is called Airflow UI Access Control (Airflow Role-Based\n Access Control, or Airflow RBAC).\n\n- **Domain Restricted Sharing (DRS)** . Cloud Composer supports\n [Domain Restricted Sharing organizational policy](/resource-manager/docs/organization-policy/org-policy-constraints).\n If you use this policy, then only users from the selected domains can\n access your environments.\n\nPrivate IP environments\n\nYou can create Cloud Composer environments in the\n[Private IP networking configuration](/composer/docs/composer-3/change-networking-type). It is also\npossible to switch an existing environment to the Private IP networking\nconfiguration.\n\nIn the Private IP mode, Airflow components of your environment (and thus your\nDAGs) do not have access to the public internet. Depending on how you\n[configure your VPC network](/composer/docs/composer-3/connect-vpc-network), a Private IP environment\ncan gain access the internet through you VPC network.\n\n\nYour environment's cluster uses Shielded VMs\n\n*Shielded VMs* are virtual machines (VMs) on Google Cloud hardened by a\nset of security controls that help defend against rootkits and bootkits.\n\nCloud Composer environments use [Shielded VMs](/shielded-vm) to run\nthe nodes of their environment cluster.\n\n\nAdvanced security features\n\nThis section lists advanced security-related features for\nCloud Composer environments.\n\nCustomer Managed Encryption Keys (CMEK)\n\nCloud Composer supports\n[Customer Managed Encryption Keys (CMEK)](/kms/docs/cmek). CMEK provide you\nwith more control over the keys used to encrypt data at rest within\na Google Cloud project.\n\nYou can [use CMEK with Cloud Composer](/composer/docs/composer-3/configure-cmek-encryption) to\nencrypt and decrypt data generated by a Cloud Composer environment.\n\nVPC Service Controls (VPC SC) Support\n\n[VPC Service Controls](/vpc-service-controls/docs/overview) is a mechanism to mitigate\ndata exfiltration risks.\n\nCloud Composer can be selected as a secured service inside\na VPC Service Controls perimeter. All underlying resources used by\nCloud Composer are configured to support VPC Service Controls\narchitecture and follow its rules. Only [Private IP](#private-ip) environments\ncan be created in a VPC SC perimeter.\n\nDeploying\n[Cloud Composer environments with VPC Service Controls](/composer/docs/composer-3/configure-vpc-sc)\ngives you:\n\n- Reduced risk of data exfiltration.\n\n- Protection against data exposure due to misconfigured access controls.\n\n- Reduced risk of malicious users copying data to unauthorized\n Google Cloud resources, or external attackers accessing\n Google Cloud resources from the internet.\n\nWeb server network access control levels (ACL)\n\nAirflow web servers in Cloud Composer are always provisioned with\nan externally accessible IP address. You can control from which IP addresses\nthe Airflow UI can be accessed. Cloud Composer supports IPv4 and\nIPv6 ranges.\n\nYou can [configure web server access restrictions](/composer/docs/composer-3/create-environments#web-server-access)\nin Google Cloud console, `gcloud`, API, and Terraform.\n\nSecret Manager as a storage for sensitive configuration data\n\nIn Cloud Composer, you can\n[configure Airflow to use Secret Manager](/composer/docs/composer-3/configure-secret-manager)\nas a backend where Airflow connection variables are stored.\n\nDAG developers can also read variables and connection stored in\nSecret Manager from the DAG code.\n\nCompliance to standards\n\nSee the pages linked below to check Cloud Composer's compliance with various standards:\n\n- [HIPAA Compliance](/security/compliance/hipaa#customer_responsibilities)\n- [Access Transparency](/assured-workloads/access-transparency/docs/supported-services)\n- [PCI DSS](/security/compliance/pci-dss)\n- ISO/IEC: [27001](/security/compliance/iso-27001), [27017](/security/compliance/iso-27017), [27018](/security/compliance/iso-27018)\n- SOC: [SOC 1](/security/compliance/soc-1), [SOC 2](/security/compliance/soc-2), [SOC 3](/security/compliance/soc-3)\n- NIST: [NIST800-53](/security/compliance/nist800-53), [NIST800-171](/security/compliance/nist800-171)\n- [DRZ FedRamp Moderate](/security/compliance/fedramp)\n- [Data Residency/Location Restrictions](/resource-manager/docs/organization-policy/defining-locations-supported-services) ([configuration guide](/composer/docs/composer-3/configure-resource-location-restrictions) for Cloud Composer)\n\nSee also\n\nSome of the security features mentioned in this article are discussed in the\nthe Airflow Summit 2020 presentation:\n[Run Airflow DAGs in a secure way](https://www.youtube.com/watch?v=QhnItssm4yU).\n\nWhat's next\n\n- [Security best practices](/composer/docs/composer-3/security-practices)\n- [Access controls](/composer/docs/composer-3/access-control)\n- [Environment architecture](/composer/docs/composer-3/environment-architecture)"]]
