Skip to content

Security howto (day-2 ops)

Status: Available in ETLantic 0.41.0. Operational checklist for pilots. Full threat model: Security.

1. Prefer python -m etlantic

Avoid PATH surprises on first machines:

python -m etlantic validate pipeline.py:SamplePipeline --profile development

2. Use named profiles and security_mode

from etlantic import Profile

production = Profile(
    name="production",
    security_mode="production",
    security_domain="production",
    plugin_allowlist={
        "etlantic-polars": "==0.41.0",
        "etlantic-sql": "==0.41.0",
    },
)

Production fail-closed trust uses security_mode (not the profile name alone). Empty allowlists fail closed in production.

3. Secrets are references only

  • Author SecretRef metadata in contracts/profiles — never embed secret values in plans, reports, or docs.
  • Resolve at runtime via env / file / optional keyring providers.
  • See Secrets Management.

4. Validate in CI before write

Do not use the built-in --profile production name — its allowlist is empty and fail-closed. Paste the Capabilities CI JSON into profiles/prod.json, or copy prod.example.json from this docs tree (checkout) / the embedded JSON on Capabilities (PyPI readers):

# From a docs checkout:
# cp docs/01_GETTING_STARTED/prod.example.json profiles/prod.json
# Or create profiles/prod.json from the Capabilities CI starter JSON.
# Review allowlist and assets, then:
python -m etlantic validate pipeline.py:SamplePipeline \
  --profile ./profiles/prod.json --format sarif

Example starter (trim allowlist to packages you install):

{
  "name": "prod-example",
  "security_mode": "production",
  "security_domain": "production",
  "orchestrator": "local",
  "dataframe_engine": "polars",
  "validation_policy": "strict",
  "portable_transform_policy": "require",
  "plugin_allowlist": {
    "etlantic-polars": "==0.41.0"
  },
  "assets": {}
}

Pin core and plugins to the same minor (==0.41.0).

5. Know the shipped security diagnostics

Shipped PMSEC* codes today: PMSEC050, PMSEC051, PMSEC060. Allowlist and trust failures use other families. See Diagnostics and Security → Diagnostics.