Custom role permissions reference

Learn about each possible permission that you can assign to custom Deployment and Dag roles.

This is feature is only available if you are on the

Enterprise

tier or above. See

Astro Plans and Pricing

.

Public Preview

This feature is in

Public Preview

.

This document contains all available permissions that you can assign to a custom Deployment role or a custom Dag role. Permissions are organized by scope and object.

Deployment

• deployment.get: Get information about the Deployment, including its details and resource configurations.
• deployment.update: Update information about the Deployment, including its details and resource configurations.
• deployment.delete: Delete the Deployment.

Deployment Agents

Airflow 3

This feature is only available for Airflow 3.x Deployments.

Remote Execution Agents are Airflow Workers, Triggerers, and Dag processors running in your remote environment with an Airflow 3 Deployment.

• deployment.agents.get: Able to get the information about Remote Execution Agents running in Remote Deployments.
• deployment.agents.update: Allow users with permissions to cordon and uncordon Remote Execution Agents in Remote Deployments.
• deployment.agents.delete: Allow users with permissions to delete Remote Execution Agents in Remote Deployments.

Deployment Agents Tokens

Airflow 3

This feature is only available for Airflow 3.x Deployments.

Tokens used by external Airflow agents, including the Remote Execution Agent, to access Airflow APIs for remote task execution.

• deployment.agentTokens.create: Create an access token to your Deployment for a Remote Execution Agent..
• deployment.agentTokens.update: Update access tokens for Remote Agents.
• deployment.agentTokens.delete: Delete access tokens for Remote Agents.

Deployment Airflow AdminMenu

• deployment.airflow.adminMenu.get: View the Admin menu in the Airflow UI.

Deployment Airflow Astronomer

• deployment.airflow.astronomer.get: View the Astronomer menu in the Airflow UI.

Deployment Airflow AuditLog

• deployment.airflow.auditLog.get: View the Audit Log menu in the Airflow UI.

Deployment Airflow BrowseMenu

• deployment.airflow.browseMenu.get: View the Browse menu in the Airflow UI.

Deployment Airflow ClusterActivity

• deployment.airflow.clusterActivity.get: View the Cluster Activity menu in the Airflow UI.

Deployment Airflow CustomMenu

• deployment.airflow.customMenu.get: Create and use custom plugins for the Aiflow UI menu.

Deployment Airflow Config

• deployment.airflow.configMenu.get: View the Config menu in the Airflow UI.

Deployment Airflow Connection

• deployment.airflow.connection.get: View connections in the Airflow UI.
• deployment.airflow.connection.create: Create connections in the Airflow UI.
• deployment.airflow.connection.update: Update connections in the Airflow UI.
• deployment.airflow.connection.delete: Delete connections in the Airflow UI.

Deployment Airflow dag

• deployment.airflow.dag.get: View dags in the Airflow UI.
• deployment.airflow.dag.update: Update dags in the Airflow UI.
• deployment.airflow.dag.delete: Delete dags in the Airflow UI.

Deployment Airflow DagCode

• deployment.airflow.dagCode.get: View the source code for dags in the Airflow UI.

Deployment Airflow DagDependencies

• deployment.airflow.dagDependencies.get: View the task dependencies for dags in the Airflow UI.

Deployment Airflow DAGRun

• deployment.airflow.dagRun.get: View dag runs in the Airflow UI.
• deployment.airflow.dagRun.create: Create dag runs in the Airflow UI.
• deployment.airflow.dagRun.update: Update dag runs in the Airflow UI.
• deployment.airflow.dagRun.delete: Delete dag runs in the Airflow UI.

Deployment Airflow Datasets

• deployment.airflow.datasets.get: View the datasets for dags in the Airflow UI.

Deployment Airflow Docs

• deployment.airflow.docs.get: View the documentation for dags in the Airflow UI.

Deployment Airflow ImportError

• deployment.airflow.importError.get: View any import errors for dags in the Airflow UI.

Deployment Airflow Job

• deployment.airflow.job.get: View scheduler jobs in the Airflow UI.

Deployment Airflow Plugin

• deployment.airflow.plugin.get: View plugins in the Airflow UI.

Deployment Airflow Pool

• deployment.airflow.pool.get: View pools in the Airflow UI.
• deployment.airflow.pool.create: Create pools in the Airflow UI.
• deployment.airflow.pool.update: Update pools in the Airflow UI.
• deployment.airflow.pool.delete: Delete pools in the Airflow UI.

Deployment Airflow Provider

• deployment.airflow.provider.get: View installed provider packages in the Airflow UI.

Deployment Airflow SlaMiss

• deployment.airflow.slaMiss.get: View details about SLA misses in the Airflow UI.

Deployment Airflow TaskInstance

• deployment.airflow.taskInstance.get: View task instances in the Airflow UI.
• deployment.airflow.taskInstance.create: Create task instances in the Airflow UI.
• deployment.airflow.taskInstance.update: Update task instances in the Airflow UI.
• deployment.airflow.taskInstance.delete: Delete task instances in the Airflow UI.

Deployment Airflow TaskLog

• deployment.airflow.taskLog.get: View task logs in the Airflow UI.

Deployment Airflow TaskReschedule

• deployment.airflow.taskReschedule.get: View task reschedules in the Airflow UI.

Deployment Airflow Trigger

• deployment.airflow.trigger.get: View information about triggers in the Airflow UI.

Deployment Airflow Variable

• deployment.airflow.variable.get: View variables in the Airflow UI.
• deployment.airflow.variable.create: Create variables in the Airflow UI.
• deployment.airflow.variable.update: Update variables in the Airflow UI.
• deployment.airflow.variable.delete: Delete variables in the Airflow UI.

Deployment Airflow Website

• deployment.airflow.website.get: Access the Airflow UI homepage.

Deployment Airflow XCom

• deployment.airflow.xcom.get: View XComs data in the Airflow UI.
• deployment.airflow.xcom.delete: View XComs data in the Airflow UI.

Deployment Alerts

• deployment.alerts.get: View configured Deployment alerts.
• deployment.alerts.create: Create Deployment-level Astro alerts in the Astro UI or through the Astro API.
• deployment.alerts.update: Update Deployment-level Astro alerts in the Astro UI or through the Astro API.
• deployment.alerts.delete: Delete Deployment-level Astro alerts in the Astro UI or through the Astro API.

Deployment ApiTokens

• deployment.apiTokens.get: View Deployment API tokens in the Astro UI or through the Astro API.
• deployment.apiTokens.create: Create Deployment API tokens in the Astro UI or through the Astro API.
• deployment.apiTokens.update: Update Deployment API tokens in the Astro UI or through the Astro API.
• deployment.apiTokens.delete: Delete Deployment API tokens in the Astro UI or through the Astro API.
• deployment.apiTokens.rotate: Rotate Deployment API tokens in the Astro UI or through the Astro API.

Deployment Deploys

• deployment.deploys.get: View deploy history for the Deployment in the Astro UI or through the Astro API.
• deployment.deploys.create: Make Deploys to the Deployment.
• deployment.deploys.update: Roll back deploys to the Deployment.

Deployment EnvObjects

• deployment.envObjects.get: View Airflow objects created in the Astro Environments page.
• deployment.envObjects.create: Create Airflow objects in the Astro Environments page.
• deployment.envObjects.update: Update Airflow objects in the Astro Environments page.
• deployment.envObjects.delete: Delete Airflow objects in the Astro Environments page.

Deployment Logs

• deployment.logs.get: View Deployment logs in the Astro UI.

Deployment Metrics

• deployment.metrics.get: View Deployment Analytics in the Astro UI.

Deployment Observability

• deployment.observability.event.create: Upload OpenLineage events.
• deployment.observability.metrics.create: Upload OpenLineage metrics.

Deployment Teams

• deployment.teams.get: View Teams belonging to a Deployment.
• deployment.teams.delete: Update Team membership to a Deployment.

Deployment Users

• deployment.users.get: View users belonging to a Deployment.
• deployment.users.delete: Update user membership to a Deployment.

Dag scope permissions

Private Preview

Dag scope permissions are part of

Dag-level access control

, which is in

Private Preview

and requires Astro Runtime 3.1-12 or later. Reach out to your account team to enable this feature.

The following permissions are available when creating a custom role with the Scope set to Dag. Unlike Deployment-scope permissions that apply to all Dags in a Deployment, Dag-scope permissions apply only to the Dags that the role is bound to by Dag tag or Dag ID. See Dag-level access control for more information about creating and assigning custom Dag roles.

Dag Airflow AuditLog

• dag.airflow.auditLog.get: View the audit log for the assigned Dags.

Dag Airflow Dag

• dag.airflow.dag.get: View the assigned Dags in the Airflow UI.
• dag.airflow.dag.update: Update the assigned Dags in the Airflow UI.
• dag.airflow.dag.delete: Delete the assigned Dags in the Airflow UI.

Dag Airflow DagCode

• dag.airflow.dagCode.get: View the source code for the assigned Dags in the Airflow UI.

Dag Airflow DagDependencies

• dag.airflow.dagDependencies.get: View the task dependencies for the assigned Dags in the Airflow UI.

Dag Airflow DagRun

• dag.airflow.dagRun.get: View Dag runs for the assigned Dags in the Airflow UI.
• dag.airflow.dagRun.create: Create Dag runs for the assigned Dags in the Airflow UI.
• dag.airflow.dagRun.update: Update Dag runs for the assigned Dags in the Airflow UI.
• dag.airflow.dagRun.delete: Delete Dag runs for the assigned Dags in the Airflow UI.

Dag Airflow HitlDetail

• dag.airflow.hitlDetail.get: View human-in-the-loop task details for the assigned Dags.
• dag.airflow.hitlDetail.update: Update human-in-the-loop task details for the assigned Dags.

Dag Airflow Task

• dag.airflow.task.get: View tasks for the assigned Dags in the Airflow UI.

Dag Airflow TaskInstance

• dag.airflow.taskInstance.get: View task instances for the assigned Dags in the Airflow UI.
• dag.airflow.taskInstance.update: Update task instances for the assigned Dags in the Airflow UI.
• dag.airflow.taskInstance.delete: Delete task instances for the assigned Dags in the Airflow UI.

Dag Airflow TaskLog

• dag.airflow.taskLog.get: View task logs for the assigned Dags in the Airflow UI.

Dag Airflow Version

• dag.airflow.version.get: View version details for the assigned Dags.
• dag.airflow.version.update: Update version details for the assigned Dags.
• dag.airflow.version.delete: Delete version details for the assigned Dags.

Dag Airflow Warning

• dag.airflow.warning.get: View warnings for the assigned Dags.
• dag.airflow.warning.delete: Delete warnings for the assigned Dags.

Dag Airflow Xcom

• dag.airflow.xcom.get: View XCom data for the assigned Dags in the Airflow UI.