Skip to content

Add allow_global option to asset access control#67251

Merged
vincbeck merged 1 commit into
apache:mainfrom
aws-mwaa:vincbeck/asset-access-control-global
May 22, 2026
Merged

Add allow_global option to asset access control#67251
vincbeck merged 1 commit into
apache:mainfrom
aws-mwaa:vincbeck/asset-access-control-global

Conversation

@vincbeck
Copy link
Copy Markdown
Contributor

This new parameter allows the user to enable/disable global Dags to consume/produce events from an asset. The allow_producer_teams option allows to allow list some teams to access events from other teams. However, some teams might want to not allow a Dag to be triggered whenever a global Dag produce an event (default behavior). Uers can do that by turning the flag allow_global to False .


Was generative AI tooling used to co-author this PR?
  • Yes (please specify the tool below)

  • Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
  • For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
  • When adding dependency, check compliance with the ASF 3rd Party License Policy.
  • For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

Comment thread airflow-core/src/airflow/models/asset.py
Copy link
Copy Markdown
Contributor

@ramitkataria ramitkataria left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's worth considering an alternate name like allow_teamless_producers but otherwise looks good to me

Copy link
Copy Markdown
Contributor

@Shrividya Shrividya left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

May be it's worth mentioning or documenting that the default for allow_global=True and setting it to False would mean accepting the events from same team producers.

@vincbeck
Copy link
Copy Markdown
Contributor Author

May be it's worth mentioning or documenting that the default for allow_global=True and setting it to False would mean accepting the events from same team producers.

Yep, will be done in #66949

@vincbeck vincbeck force-pushed the vincbeck/asset-access-control-global branch from 66de677 to 33651b6 Compare May 22, 2026 12:33
@vincbeck vincbeck merged commit 8c2fa49 into apache:main May 22, 2026
99 checks passed
@vincbeck vincbeck deleted the vincbeck/asset-access-control-global branch May 22, 2026 14:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants