What's a proxy role? Why is it different from workspace role?

In DagKnows, a workspace role defines what a user can do within the DagKnows web application—such as viewing, creating, editing, deleting, or executing tasks.

However, when a task is executed, it runs on a proxy, and this is where proxy roles come into play.

A proxy role is used to control which credentials a user can access when tasks are executed on the proxy. While the task logic may be the same for all users, the credentials used can vary by user. For example, a task like “List my EC2 instances” may be common, but:

• User A may run it using their own AWS credentials.
• User B may run it with a different set of AWS credentials.

These credentials are securely stored in the HashiCorp Vault on the proxy, organized under named roles. Only users with the appropriate proxy role are allowed to access the credentials associated with that role.

This separation ensures that:

• Multiple users can run the same task with different credentials.
• Access to credentials is tightly controlled and isolated via proxy roles.

When a user executes a task, they reference a specific credential label in their script. DagKnows will:

1. Authenticate the user with the Vault.
2. Check if the user’s proxy role allows access to the requested credential.
3. If permitted, retrieve and use the credentials securely during task execution.