Access the Airflow web interface

Cloud Composer 3 | Cloud Composer 2 | Cloud Composer 1

Apache Airflow includes a web user interface calledAirflow UI, which you can use to manage Airflow DAGs, viewDAG run logs, monitor Airflow, and perform administrative actions.

About the Airflow web server

Each Cloud Composer environment has a web server thatruns the Airflow UI. The web server is a part ofCloud Composer environment architecture.

Before you begin

  • You must have a role that can view Cloud Composer environments.For more information, seeAccess control.

  • During the environment creation, Cloud Composer configures theURL for the web server that runs the Airflow UI. The URL isnon-customizable.

  • Cloud Composer 3 supports theAirflow UI Access Control (Airflow Role-Based AccessControl) feature for the Airflow UI.

  • If theAPI Controls>Unconfigured third-party apps>Don't allow users to access any third-party apps optionis enabled in Google Workspace and the Apache Airflow inCloud Composer app is not explicitly allowed, then users are notable to access the Airflow UI unless they explicitly allow theapplication. To allow access, perform steps provided inAllow access to Airflow UI in Google Workspace.

  • If Chrome Enterprise PremiumContext-Aware Access bindings are used withaccess levels that rely on device attributes, and the Apache Airflow inCloud Composer app is not exempted, then it's not possible toaccess the Airflow UI because of a login loop. To allow access, performsteps provided inAllow access to Airflow UI in Context-Aware Access bindings.

  • Ifingress rules are configured in aVPC Service Controls perimeter that protects the project, and the ingress rulethat allows access to the Cloud Composer service usesANY_SERVICE_ACCOUNT orANY_USER_ACCOUNT identity type, then users can'taccess the Airflow UI, ending up in a login loop. For more informationabout addressing this scenario, seeAllow access to Airflow UI in VPC Service Controls ingress rules.

  • Cloud Composer doesn't support usingthird-party identities iningress and egress rules to allowApache Airflow UI operations. However, you can use theANY_IDENTITYidentity type in ingress and egress rules to allow access to all identities,including third-party identities. For more information about theANY_IDENTITY identity type, seeIngress and egress rules.

Access the Airflow UI

In Cloud Composer 3, the Airflow web server runsin the tenant project of your environment. The web server isdeployed to thecomposer.googleusercontent.com domain and provides access tothe Airflow UI.

Cloud Composer 3 provides access to the interface based on user identitiesand IAM policy bindings defined for users.

Access the Airflow UI from the Google Cloud console

To access the Airflow UI from the Google Cloud console:

  1. In the Google Cloud console, go to theEnvironments page.

    Go to Environments

  2. In theAirflow webserver column, follow theAirflow link for yourenvironment.

  3. Sign in with a Google Account that has the appropriate permissions.

Obtain the Airflow UI URL with Google Cloud CLI

You can access the Airflow UI from any web browser. To get the URLfor the Airflow UI, run the following command in Google Cloud CLI:

gcloudcomposerenvironmentsdescribeENVIRONMENT_NAME\--locationLOCATION

Replace the following:

  • ENVIRONMENT_NAME: the name of your environment.
  • LOCATION: the region where the environment is located.

The Google Cloud CLI command shows the properties of aCloud Composer environment, including the URLs for the Airflow UI.The URLs are listed asairflowUri andairflowByoidUri:

config:airflowUri:https://example-dot-us-central1.composer.googleusercontent.comairflowByoidUri:https://example-dot-us-central1.composer.byoid.googleusercontent.com

Restart the web server

When debugging or troubleshooting Cloud Composer environments, some issuesmay be resolved by restarting the Airflow web server. You can restart the webserver using therestartWebServer APIor therestart-web-server command in Google Cloud CLI:

gcloudcomposerenvironmentsrestart-web-serverENVIRONMENT_NAME\--location=LOCATION

Replace the following:

  • ENVIRONMENT_NAME: the name of your environment.
  • LOCATION: the region where the environment is located.

Configure web server network access

The Airflow web server access parameters don't depend on your environment'snetworking configuration. Instead, you configure web server access separately.For example, a Private IP environment can still have the Airflow UI accessiblefrom the internet.

Note: The Airflow web server of your environment is alwaysprotected by IAM, regardless of the IP ranges that areallowed to access it.

It's not possible to configure the allowed IP ranges to be private IP addresses.

Important: In some cases, changes to the web server access parameters can takeup to 10 minutes to propagate.

Console

  1. In the Google Cloud console, go to theEnvironments page.

    Go to Environments

  2. In the list of environments, click the name of your environment.TheEnvironment details page opens.

  3. Go to theEnvironment configuration tab.

  4. In theNetwork configuration section, find theWeb server access control item and clickEdit.

  5. In theWeb server network access control dialog:

    • To provide access to the Airflow web server from all IP addresses,selectAllow access from all IP addresses.

    • To restrict access only to specific IP ranges, selectAllow access only from specific IP addresses. In theIP rangefield, specify an IP range in the CIDR notation. IntheDescription field, specify an optional description for thisrange. If you want to specify more than one range, clickAdd IPrange.

    • To forbid access for all IP addresses, selectAllow access only fromspecific IP addresses and clickDelete item next to the emptyrange entry.

gcloud

When you update an environment, the following arguments control web serveraccess parameters:

  • --web-server-allow-all provides access to Airflow from all IP addresses.This is the default option.

  • --update-web-server-allow-ip restricts access only to specific source IPranges. To specify several IP ranges, use this argument multiple times.

  • --web-server-deny-all forbids access for all IP addresses.

gcloudcomposerenvironmentsupdateENVIRONMENT_NAME\--locationLOCATION\--update-web-server-allow-ipip_range=WS_IP_RANGE,description=WS_RANGE_DESCRIPTION

Replace the following:

  • ENVIRONMENT_NAME: the name of your environment.
  • LOCATION: the region where the environment is located.
  • WS_IP_RANGE: the IP range, in the CIDR notation, that can access theAirflow UI.
  • WS_RANGE_DESCRIPTION: the description of the IP range.

Example:

gcloudcomposerenvironmentsupdateexample-environment\--locationus-central1\--update-web-server-allow-ipip_range=192.0.2.0/24,description="example range"\--update-web-server-allow-ipip_range=192.0.4.0/24,description="example range 2"

API

  1. Construct an [environments.patch][api-patch] API request.

  2. In this request:

    1. In theupdateMask parameter, specify theconfig.webServerNetworkAccessControl mask.

    2. In the request body, specify how Airflow task logs must besaved:

      • To provide access to Airflow from all IP addresses, specify anemptyconfig element (thewebServerNetworkAccessControlelement must not be present).

      • To restrict access only to specific IP ranges, specify one or moreranges inallowedIpRanges.

      • To forbid access for all IP addresses, specify an emptywebServerNetworkAccessControl element. ThewebServerNetworkAccessControl element must be present, butmust not contain anallowedIpRanges element.

{"config":{"webServerNetworkAccessControl":{"allowedIpRanges":[{"value":"WS_IP_RANGE","description":"WS_RANGE_DESCRIPTION"}]}}}

Replace the following:

  • WS_IP_RANGE: the IP range, in the CIDR notation, that can access theAirflow UI.
  • WS_RANGE_DESCRIPTION: the description of the IP range.

Example:

// PATCH https://composer.googleapis.com/v1/projects/example-project/// locations/us-central1/environments/example-environment?updateMask=// config.webServerNetworkAccessControl{"config":{"webServerNetworkAccessControl":{"allowedIpRanges":[{"value":"192.0.2.0/24","description":"example range"},{"value":"192.0.4.0/24","description":"example range 2"}]}}}

Terraform

In theallowed_ip_range block, in theweb_server_network_access_controlspecify IP ranges that can access web server.

resource"google_composer_environment""example"{provider=google-betaname="ENVIRONMENT_NAME"region="LOCATION"config{web_server_network_access_control{allowed_ip_range{value="WS_IP_RANGE"description="WS_RANGE_DESCRIPTION"}}}}

Replace the following:

  • WS_IP_RANGE: the IP range, in the CIDR notation, that can access theAirflow UI.
  • WS_RANGE_DESCRIPTION: the description of the IP range.

Example:

resource"google_composer_environment""example"{provider=google-betaname="example-environment"region="us-central1"config{web_server_network_access_control{allowed_ip_range{value="192.0.2.0/24"description="example range"},allowed_ip_range{value="192.0.4.0/24"description="example range 2"}}}

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-12-15 UTC.