Access and Authentication

Docs > Actions > Workflow Automation > Access and Authentication

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

A few tools control access and authentication for workflows and their components.

Workflow identity

Every run of a workflow uses a single Datadog identity, controlled by the workflow’s Run as setting. That identity determines:

Which connections a run can resolve, including connections that use private action runners
Which Datadog resources a run can read and modify
Which user a run’s actions are attributed to, in audit trails and in the products those actions touch

A workflow can run as one of the following identities:

Owner: The workflow runs as its owner, and any editor of the workflow can access the same resources as the owner. A new workflow runs as its owner by default.
Initiator: The workflow runs as the user who triggered the run, so each run is limited to the resources that user can access. The Initiator identity is only supported for triggers that have an end user.
Service Account: The workflow runs as a service account associated with the workflow. Use a service account to control the exact permissions a run has, with roles you choose for the workflow.

Set the workflow identity

Select an identity when you publish a workflow, or change it at any time:

In the workflow editor, click the cog (Settings) icon.
Click Edit permissions.
Under Run as, select Owner, Initiator, or Service Account.
Click Save.

The following restrictions apply:

Only the owner of the workflow can select Owner or Initiator.
To select Service Account, you need either the Datadog Admin Role or a custom role with the Service Account Write permission.

To see the identity a workflow uses, hover over the workflow name in the editor and read the Run as field.

Run as the owner

When a workflow runs as its owner, every run uses the owner’s identity, whoever triggers it. A run can use the connections and Datadog resources the owner can access, even when the user who triggered it cannot access them.

The owner resolves the connections defined in the workflow actions. The owner needs the connections_resolve permission, plus Resolver access to each connection the workflow uses.

Run as the initiator

When a workflow runs as the initiator, each run uses the identity of the user who triggered it. A run can only use the connections and Datadog resources that this user can access, and the actions the workflow takes are attributed to them. For example, if the workflow declares an incident, the incident is created by the user who triggered the workflow.

The initiator resolves the connections defined in the workflow actions. Each user who triggers the workflow needs the connections_resolve permission, plus Resolver access to each connection the workflow uses.

Run as a service account

When a workflow runs as a service account, every run uses that account’s identity, whoever triggers it. Because you choose which roles the service account has, you control the exact permissions a run has, independently of any user’s permissions.

Attach an existing service account to the workflow, or create a service account when you set the identity. When you create one, you select its roles. You can assign any subset of the roles you have. With the User Access Manage permission, you can assign any role in your organization. For more information, see Service accounts or Role based access control.

The service account resolves the connections defined in the workflow actions. It needs a role with the workflows_run and connections_resolve permissions, plus Resolver access to each connection the workflow uses.

Action credentials

Because workflow actions connect with external software systems, you may need to authenticate your Datadog account to the corresponding integration. A workflow can run successfully only if every workflow action that requires authentication can verify the identity of your Datadog account.

Workflow actions can be authenticated in two ways:

Credentials and permissions configured in the integration tile
Connection credentials

For more information on configuring credentials, see Connections.

Workflow permissions

Use role-based access control (RBAC) to control access to your workflows and connections. To see the list of permissions that apply to workflows and connections, see Datadog Role Permissions.

By default, the author of a workflow or connection is the only user who receives Editor access. The rest of the Datadog organization receives Viewer access to the workflow or connection.

Restrict access on a specific connection

Set permissions on each connection to limit modifications or restrict their use. The granular permissions include Viewer, Resolver, and Editor. By default, only the author of the connection receives Editor access. The author can choose to grant access to additional users, roles, or teams.

Viewer: Can view the connection
Resolver: Can resolve and view the connection
Editor: Can edit, resolve, and view the connection

Resolving a connection includes getting the connection object assigned to a step and retrieving the secret associated with it.

Follow the steps below to modify the permissions on a specific connection:

Navigate to the Workflow Automation page.
Click Connections in the upper right. A list of connections appears.
Hover over the connection on which you would like to set granular permissions. Edit, Permissions, and Delete icons appear on the right.
Click the padlock (Permissions) icon.
Select Restrict Access.
Select a role from the dropdown menu. Click Add. The role you selected populates into the bottom of the dialog box.
Next to the role name, select your desired permission from the dropdown menu.
If you would like to remove access from a role, click the trash can icon to the right of the role name.
Click Save.

Restrict access on a specific workflow

Set permissions on each workflow to restrict modifications or usage of the workflow. The granular permissions include Viewer, Runner, and Editor. By default, only the author of the workflow receives Editor access. The author can choose to grant access to additional users, roles, or teams.

Viewer: Can view the workflow
Runner: Can run and view the workflow
Editor: Can edit, run, and view the workflow

You can restrict access on a specific workflow either from the workflow list page or from the workflow canvas while editing the workflow.

Restricting permissions from the workflow list page

Navigate to the Workflow Automation page.
Hover over the workflow on which you would like to set granular permissions. Action icons, including Permissions, appear on the right.
Click the padlock (Permissions) icon.
Select Restrict Access.
Select a role from the dropdown menu. Click Add. The role you selected populates into the bottom of the dialog box.
Next to the role name, select your desired permission from the dropdown menu.
If you would like to remove access from a role, click the trash can icon to the right of the role name.
Click Save.

Restricting permissions from the workflow editor

In the workflow editor, click the cog (Settings) icon.
Select Edit permissions from the dropdown.
Under Who has access, select Custom.
Select Restrict Access.
Select a role from the dropdown menu. Click Add. The role you selected populates into the bottom of the dialog box.
Next to the role name, select your desired permission from the dropdown menu.
If you would like to remove access from a role, click the trash can icon to the right of the role name.
Click Done, then click Save.