[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-26 (世界標準時間)。"],[[["\u003cp\u003eThis page outlines how to configure Google Cloud's Secret Manager to securely store and manage Airflow connections and secrets within Cloud Composer 3.\u003c/p\u003e\n"],["\u003cp\u003eEnabling the Secret Manager API and configuring access control is crucial, which can be done by granting the "Secret Manager Secret Accessor" role to the environment's service account, allowing it to access stored secrets.\u003c/p\u003e\n"],["\u003cp\u003eTo enable and configure the Secret Manager backend, you must override the Airflow configuration options with specific settings, including the \u003ccode\u003ebackend\u003c/code\u003e key set to \u003ccode\u003eairflow.providers.google.cloud.secrets.secret_manager.CloudSecretManagerBackend\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eConnections and variables must be created in Secret Manager using a specific naming convention, which involves the \u003ccode\u003e[connection_prefix]\u003c/code\u003e or \u003ccode\u003e[variables_prefix]\u003c/code\u003e, \u003ccode\u003e[sep]\u003c/code\u003e, and the connection or variable name, with default values provided for the prefix and separator.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer will check Secret Manager first when fetching variables and connections, and if they are not found, it will then check the environment variables and the Airflow database.\u003c/p\u003e\n"]]],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n**Cloud Composer 3** \\| [Cloud Composer 2](/composer/docs/composer-2/configure-secret-manager \"View this page for Cloud Composer 2\") \\| [Cloud Composer 1](/composer/docs/composer-1/configure-secret-manager \"View this page for Cloud Composer 1\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page shows how to use [Secret Manager](/secret-manager/docs)\nto securely store Airflow connections and secrets.\n\nConfigure Secret Manager for your environment\n\nThis section explains how to configure Secret Manager so that you\ncan use secrets with your Cloud Composer environment.\n\nEnable the Secret Manager API \n\nConsole\n\n\nEnable the Secret Manager API:\n\n\n```bash\ngcloud services enable secretmanager.googleapis.com\n```\n\n\u003cbr /\u003e\n\ngcloud\n\n\nEnable the Secret Manager API:\n\n\n```bash\ngcloud services enable secretmanager.googleapis.com\n```\n\n\u003cbr /\u003e\n\nConfigure access control\n\nYou must configure access control so that Airflow can access secrets stored in\nSecret Manager.\n\nTo do so, the service account that accesses secrets must have a role with\nthe `secretmanager.versions.access` permission. For example,\nthe **Secret Manager Secret Accessor** role includes this permission.\n\nYou can grant this role at the\n[Secret, Project, Folder, or Org level](/secret-manager/docs/access-control#least-privilege).\n\nUse one of the following options:\n\n- (Recommended) [Grant this role](/iam/docs/granting-changing-revoking-access#grant-single-role)\n to the [service account of your environment](/composer/docs/composer-3/access-control#service-account).\n\n- Override the service account under which Airflow accesses\n Secret Manager.\n\n | **Caution:** This method is less advisable, because it requires storing service account credentials in a file, which increases the risk that they might be compromised.\n 1. [Grant this role](/iam/docs/granting-changing-revoking-access#grant-single-role) to a service account.\n 2. Set the `gcp_key_path` parameter of the [`backend_kwargs` Airflow configuration option](#configure-backend) to point to a JSON file with the service account credentials.\n\nEnable and configure the Secret Manager backend\n\n1. [Override](/composer/docs/composer-3/override-airflow-configurations) the following Airflow configuration option:\n\n | Section | Key | Value |\n |-----------|-----------|-----------------------------------------------------------------------------------|\n | `secrets` | `backend` | `airflow.providers.google.cloud.secrets.secret_manager.CloudSecretManagerBackend` |\n\n | **Caution:** Do not use `airflow.contrib.secrets.gcp_secrets_manager.CloudSecretsManagerBackend` because this value does not allow you to view logs in the Airflow UI.\n2. *(Airflow 2.10.2 and later)*\n Make sure that the `[secrets]backends_order` Airflow configuration option\n specifies a secrets search order that has a `custom` secrets backend in\n it. The default value of this option already contains this value.\n\n | Section | Key | Value |\n |-----------|------------------|---------------------------------------------------|\n | `secrets` | `backends_order` | (default) `custom,environment_variable,metastore` |\n\n3. Add optional settings by [overriding](/composer/docs/composer-3/override-airflow-configurations) the following Airflow\n configuration option:\n\n | Section | Key | Value |\n |-----------|------------------|--------------------------------|\n | `secrets` | `backend_kwargs` | See the following description. |\n\n The `backend_kwargs` value is the JSON representation of the\n [`backend_kwargs` object](https://airflow.apache.org/docs/apache-airflow-providers-google/stable/secrets-backends/google-cloud-secret-manager-backend.html#backend-parameters)\n with the following fields:\n - `connections_prefix`: prefix of the secret name to read in order to get Connections. The default is `airflow-connections`.\n - `variables_prefix`: prefix of the secret name to read in order to get Variables. The default is: `airflow-variables`.\n - `gcp_key_path`: path to the Google Cloud Credential JSON file (if not provided, the default service account is used).\n - `gcp_keyfile_dict`: Google Cloud Credential JSON dictionary. Mutually exclusive with `gcp_key_path`.\n - `sep`: separator used to concatenate `connections_prefix` and `conn_id`. The default is `-`.\n - `project_id`: Google Cloud Project Id where secrets are stored.\n\n For example, the value of `backend_kwargs` can be:\n `{\"project_id\": \"\u003cproject id\u003e\", \"connections_prefix\":\"example-connections\", \"variables_prefix\":\"example-variables\", \"sep\":\"-\"}`.\n | **Note:** The `Keyfile Secret Name (in GCP Secret Manager)` option in Airflow connection is supported only when Secret Manager and Cloud Composer are in the same Google Cloud project.\n\nAdd connections and variables in Secret Manager\n\nCreate secrets by following steps outlined in\n[Creating secrets and versions](/secret-manager/docs/creating-and-accessing-secrets).\n\nVariables\n\n- Must use the `[variables_prefix][sep][variable_name]` format.\n- The default value for `[variables_prefix]` is `airflow-variables`.\n- The default separator `[sep]` is `-`.\n\nFor example, if the variable name is `example-var`, then the secret name\nis `airflow-variables-example-var`.\n| **Note:** If you want to use different values for `[variables_prefix]`, `[connection_prefix]` or `[sep]`, use the optional settings as described further in the [Enable and configure Secret Manager backend](#configure-backend) section.\n\nConnection names\n\n- Must use the `[connection_prefix][sep][connection_name]` format.\n- The default value for `[connection_prefix]` is `airflow-connections`.\n- The default separator `[sep]` is `-`.\n\nFor example, if the connection name is `exampleConnection`, then the secret\nname is `airflow-connections-exampleConnection`.\n\nConnection values\n\n- Must use\n [URI representation](https://airflow.apache.org/docs/apache-airflow/stable/howto/connection.html#generating-connection-uri). For example,\n `postgresql://login:secret@examplehost:9000`.\n\n- The URI must be [URL-encoded](https://www.w3schools.com/tags/ref_urlencode.ASP)\n (percent encoded). For example, a password that has a space symbol\n in it must be URL-encoded as follows:\n `postgresql://login:secret%20password@examplehost:9000`.\n\nAirflow has a\n[convenience method](https://airflow.apache.org/docs/apache-airflow/stable/howto/connection.html#generating-connection-uri) for generating connection\nURIs. An example of how to encode a complex URL with JSON extras is available\nin the [Airflow documentation](https://airflow.apache.org/docs/apache-airflow-providers-mysql/stable/connections/mysql.html).\n\nUse Secret Manager with Cloud Composer\n\nWhen fetching variables and connections, Cloud Composer checks\nSecret Manager first. If the requested variable or connection is not\nfound, Cloud Composer then checks the environment variables and\nthe Airflow database.\n| **Note:** For security reasons, variables and connections from Secret Manager are not visible in the Airflow UI.\n\nRead variables using Jinja templating\n\nYou can use Secret Manager to read variables with\n[Jinja templating](https://airflow.apache.org/docs/apache-airflow/stable/tutorial.html#templating-with-jinja) for templated operator fields\n(resolved at the execution time).\n\nFor the `airflow-variables-secret_filename` secret: \n\n file_name = '{{var.value.secret_filename}}'\n\nRead variables using custom operators and callbacks\n\nYou can also use Secret Manager to read variables in custom\noperators or callback methods from operators. Reading variables from\ninside DAGs can negatively impact performance, so use Jinja templates\nif you want to use variables in your DAGs.\n\nFor example, for the `airflow-variables-secret_filename` secret: \n\n from airflow.models.variable import Variable\n file_name = Variable.get('secret_filename')\n\nRead connections\n\nUnless you are writing a custom operator, you should rarely need to\naccess connections directly. Most hooks get the connection name as their\ninstantiation parameter, and should retrieve connections from the secret\nbackend automatically when tasks are executed.\n\nReading connections directly may be useful when writing your own hook.\n\nFor example, for the `airflow-connections-exampleConnection` connection: \n\n from airflow.hooks.base_hook import BaseHook\n exampleConnection = BaseHook.get_connection('exampleConnection')\n\n`BaseHook.get_connection` returns a `Connection` object. It is\npossible to get the URI string representation of a connection like this: \n\n exampleConnectionUri = BaseHook.get_connection('exampleConnection').get_uri()\n\nWhat's next\n\n- [Override Airflow configuration options](/composer/docs/composer-3/override-airflow-configurations)\n- [Access the Airflow REST API](/composer/docs/composer-3/access-airflow-api)"]]
