[Yandex Cloud documentation](../../index.md) > [Yandex Lockbox](../index.md) > [Tutorials](index.md) > Storing Apache Airflow™ connections and variables in Yandex Lockbox

# Storing Apache Airflow™ connections and variables in Yandex Lockbox

# Storing Apache Airflow™ connections and variables in Yandex Lockbox

When working with Yandex Managed Service for Apache Airflow™, you can use [Yandex Lockbox](../index.md) to store artifacts that can be used in DAG files: connections, variables, and configuration data. Yandex Lockbox integrates into Managed Service for Apache Airflow™ via the [Yandex Lockbox Secret Backend](https://airflow.apache.org/docs/apache-airflow-providers-yandex/stable/secrets-backends/yandex-cloud-lockbox-secret-backend.html) provider. As a result, access to the secret storage is configured automatically.

Below, we consider a [directed acyclic graph (DAG)](../../managed-airflow/concepts/index.md#about-the-service) running the `SELECT 1;` SQL query to a database in a Yandex Managed Service for PostgreSQL cluster. Data for connecting to the DB is stored in Yandex Lockbox and automatically inserted into the graph.

To use configuration data from a Yandex Lockbox secret in the graph:

1. [Set up your infrastructure](#create-infrastracture).
1. [Create a Yandex Lockbox secret](#create-lockbox-secret).
1. [Prepare the DAG file and run the graph](#dag).
1. [Check the result](#check-result).

If you no longer need the resources you created, [delete them](#clear-out).


## Required paid resources {#paid-resources}

The support cost for this solution includes:

* Managed Service for PostgreSQL cluster fee: computing resources and disk space (see [Managed Service for PostgreSQL pricing](../../managed-postgresql/pricing.md)).
* Managed Service for Apache Airflow™ cluster fee: computing resources and disk space (see [Apache Airflow™ pricing](../../managed-airflow/pricing.md)).
* Object Storage bucket fee: data storage and data operations (see [Object Storage pricing](../../storage/pricing.md)).
* Fee for using a Yandex Lockbox secret (see [Yandex Lockbox pricing](../pricing.md)).
* Fee for public IP addresses if public access is enabled for cluster hosts (see [Virtual Private Cloud pricing](../../vpc/pricing.md)).


## Set up your infrastructure {#create-infrastracture}

1. [Create a service account](../../iam/operations/sa/create.md#create-sa) named `airflow-sa` with the following roles:

   * `managed-airflow.integrationProvider`
   * `lockbox.payloadViewer`

   {% note info }

   There is no need to assign the `lockbox.payloadViewer` role for the whole folder. It is enough to [assign it for a specific Yandex Lockbox secret](../operations/secret-access.md) once you [create it](#create-lockbox-secret).

   {% endnote %}

1. [Create an Object Storage](../../storage/operations/buckets/create.md) bucket in any configuration.

1. [Edit the ACL](../../storage/operations/buckets/edit-acl.md) of the new bucket to give the `READ` permission to the `airflow-sa` service account.

1. [Create a Managed Service for Apache Airflow™ cluster](../../managed-airflow/operations/cluster-create.md#create-cluster) with the following parameters:

   * **Service account**: `airflow-sa`.
   * **Bucket name**: Name of the new bucket.
   * **Use Lockbox Secret Backend**: Make sure to enable this option.

1. [Create a Managed Service for PostgreSQL](../../managed-postgresql/operations/cluster-create.md#create-cluster) cluster with the following parameters:

   * **DB name**: `db1`
   * **Username**: `user1`
   * **Password**: `user1-password`

## Create a Yandex Lockbox secret {#create-lockbox-secret}

For the Apache Airflow™ cluster to work correctly, your Yandex Lockbox secret's name must have this format: `airflow/<artifact_type>/<artifact_ID>`, where:

   * `<artifact_type>`: Type of the artifact to store in the secret. The following types are available:
     * `connections`: Connections.
     * `variables`: Variables.
     * `config`: Configuration data.
   * `<artifact_ID>`: ID to use to access the artifact in Apache Airflow™.

[Create a Yandex Lockbox](../operations/secret-create.md) secret with the following parameters:

   * **Name**: `airflow/connections/pg`.
   * **Secret type**: `Custom`.
   * **Key**: `airflow/connections/pg`.
   * **Value**: Select **Text** and specify the following contents:

      ```json
      {
        "conn_type": "postgres",
        "host": "<PostgreSQL_cluster_host_FQDN>",
        "port": 6432,
        "schema": "db1",
        "login": "user1",
        "password": "user1-password"
      }
      ```

The secret will store the data to connect to the database in the Managed Service for PostgreSQL cluster.

For more information on how to get the FQDN of a PostgreSQL cluster host, see [this guide](../../managed-postgresql/operations/connect/index.md#fqdn).

## Prepare the DAG file and run the graph {#dag}

1. Create a local file named `test_lockbox_connection.py` and paste the following script to it:

   ```python
   from airflow import DAG
   from airflow.providers.postgres.operators.postgres import PostgresOperator
   from datetime import datetime

   with DAG(
     dag_id='test_lockbox_connection',
     start_date=datetime(2024, 4, 19),
     schedule="@once",
     catchup=False,
   ) as dag:
     check_conn = PostgresOperator(
         task_id="check_conn",
         postgres_conn_id='pg',
         sql="SELECT 1;",
     )
   ```

1. Upload the `test_lockbox_connection.py` DAG file to the bucket you created earlier. This will automatically create a graph with the same name in the Apache Airflow™ web interface.

1. [Open the Apache Airflow™ web interface](../../managed-airflow/operations/af-interfaces.md#web-gui).

1. Make sure a new graph named `test_lockbox_connection` has appeared in the **DAGs** section.

   It may take a few minutes to load a DAG file from the bucket.

1. To run the graph, click ![image](../../_assets/managed-airflow/trigger-dag.png =18x) in the line with its name.

## Check the result {#check-result}

To check the result in the Apache Airflow™ web interface:

1. In the **DAGs** section, open the `test_lockbox_connection` graph.
1. Go to the **Graph** section.
1. Select **check_conn**.
1. Go to **Logs**.
1. Make sure the logs contain the `Rows affected: 1` line. This means the query was successful.

## Delete the resources you created {#clear-out}

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:

1. [Service account](../../iam/operations/sa/delete.md)
1. [Object Storage bucket](../../storage/operations/buckets/delete.md)
1. [Yandex Lockbox secret](../operations/secret-delete.md)
1. [Managed Service for Apache Airflow™ cluster](../../managed-airflow/operations/cluster-delete.md#delete)
1. [Managed Service for PostgreSQL cluster](../../managed-postgresql/operations/cluster-delete.md#delete)