Access and Authentication

Workflow Automation is not supported for your selected Datadog site ().

A few tools control access and authentication for workflows and their components.

Workflow identity

A workflow can run using the identity of the owner of the workflow, or a service account associated with the workflow. By default, a workflow uses the Datadog user identity of its author.

Use a service account

A service account can be associated with a workflow and act as the identity of the workflow when it runs. A service account can:

  • resolve the connections defined in the workflow actions at runtime
  • provide an identity for workflow executions
  • provide an identity for workflow audit trails

To create a service account for a workflow, you must have either the Datadog admin role, or a custom role with the Service Account Write permission. The service account you create adopts your role and permissions. For more information on service accounts and permissions, see Service accounts or Role based access control.

Associate a service account with a workflow

You can dynamically create a service account for your workflow when you add an automatic trigger.

  1. Click the cog (Settings) icon.
  2. Click Create a service account.
  3. Select a role for your service account user.
  4. Click Create to save the service account.
  5. Save your workflow to apply the changes.

When you run a workflow, the service account user resolves the connections defined in the workflow actions. Therefore, the service account user needs the connections_resolve permission. The Datadog Admin Role and the Datadog Standard Role include the connections_resolve permission.

View service account details

  1. Click the cog (Settings) icon.
  2. Select your service account from the dropdown menu.

Remove a service account associated with workflow

  1. Click the cog (Settings) icon.
  2. Select your service account from the dropdown menu.
  3. Click Remove service account.

Action credentials

Because workflow actions connect with external software systems, you may need to authenticate your Datadog account to the corresponding integration. A workflow can run successfully only if every workflow action that requires authentication can verify the identity of your Datadog account.

Workflow actions can be authenticated in two ways:

  • Credentials and permissions configured in the integration tile
  • Connection credentials

For more information on configuring credentials, see Connections.

Workflow permissions

Use role-based access control (RBAC) to control access to your workflows and connections. To see the list of permissions that apply to workflows and connections, see Datadog Role Permissions.

Restrict connection use

Set permissions on each connection to limit modifications or restrict their use. The granular permissions include Viewer, Resolver, and Editor.

Can view
Can resolve and view
Can edit, resolve, and view

Resolving a connection includes getting the connection object assigned to a step and retrieving the secret associated with it.

Follow the steps below to modify the permissions on a specific connection:

  1. Navigate to the Workflow Automation page.
  2. Click Connections in the upper right. A list of connections appears.
  3. Hover over the connection on which you would like to set granular permissions. Edit, Permissions, and Delete icons appear on the right.
  4. Click the padlock (Permissions) icon.
  5. Select Restrict Access.
  6. Select a role from the dropdown menu. Click Add. The role you selected populates into the bottom of the dialog box.
  7. Next to the role name, select your desired permission from the dropdown menu.
  8. If you would like to remove access from a role, click the trash can icon to the right of the role name.
  9. Click Save.

Further Reading