Managing Proxies

In DagKnows, a workspace role defines what a user can do within the DagKnows web application—such as viewing, creating, editing, deleting, or executing tasks.

However, when a task is executed, it runs on a proxy, and this is where proxy roles come into play.

A proxy role is used to control which credentials a user can access when tasks are executed on the proxy. While the task logic may be the same for all users, the credentials used can vary by user. For example, a task like “List my EC2 instances” may be common, but:

• User A may run it using their own AWS credentials.
• User B may run it with a different set of AWS credentials.

These credentials are securely stored in the HashiCorp Vault on the proxy, organized under named roles. Only users with the appropriate proxy role are allowed to access the credentials associated with that role.

This separation ensures that:

• Multiple users can run the same task with different credentials.
• Access to credentials is tightly controlled and isolated via proxy roles.

When a user executes a task, they reference a specific credential label in their script. DagKnows will:

1. Authenticate the user with the Vault.
2. Check if the user’s proxy role allows access to the requested credential.
3. If permitted, retrieve and use the credentials securely during task execution.

• Go to Settings
• Go to Proxies tab
• Find the table to add a new proxy role

• Specify the name of the proxy role to add. All lowercase. No special characters.
• Click Add
• Ensure the proxy role appears in the table below. If it doesn't, refresh the page and check again.

• Go to Users (left nav bar)
• Find the user to assign a proxy role to. Click on it.
• Click Modify settings. The user's settings will appear on the right side form.
• Locate the table for Proxy Roles
• Locate the proxy to assign the role on for this user
• Select the role from the dropdown.
• Click Modify button to save the settings