A service account can be used to automate management of objects like dashboard, alerts, etc.
- A service account uses a token to authenticate.
- A service account must have permissions to perform tasks. For dashboards and alerts, the service account must also have access.
- By default, service accounts do not get any individual permission by default
- Each account is automatically added to the Everyone group and inherits the Everyone group permissions (if any)
- Service account can be added to any group to get that groups permissions.
- A service account can’t perform the UI operations that user accounts can perform by default. Service Accounts can be used to automate management of objects like Dashboard, Alerts, etc. If a user wants to automate the process of managing certain objects then they can assign Dashboard management permission or Alert management permission to a Service Account and add it to the ACL for the objects that the user wants to manage automatically through a Service Account
Service Accounts Basics
If you build a service or tool that manages proxies or ingests data, then that tool must authenticate to the Wavefront API. Service accounts support this type of authentication.
Create a service account from the Wavefront UI.
Note: The service account name must be unique.
- Give the account the permissions it needs.
Configure your tool to pass the service account credentials (API token) to the Wavefront API.
The tool authenticates seamlessly to the API without embedding any secret keys or user credentials in your instance, image, or application code.
Service accounts can perform get, modify, and delete tasks only if they have the necessary permissions. You can disable a service account if you temporarily don’t need it, or delete it permanently.
Create a Service Account
Creating a service account is different from creating a user account.
- From the gear icon, select Account Management.
- Click the Service Accounts tab, and click Create New Account
- On the New Service Account page, specify the account details and click Create.
|Account ID||ID of the account. We prefix this ID with sa::.
A service account name must be unique. Wavefront converts service account ID to lower case. Users can type upper case or lower case -- this helps avoid duplicates.
|Tokens||List of API tokens that the service account can use to authenticate to Wavefront.
|Groups||By default, service accounts are added to the Everyone group and you cannot remove them. If you give permissions to the Everyone group, all the service account get those permissions. You can also add a service accounts to other groups.|
|Permissions||Individual permissions assigned to this service account. For example, give the account Proxies permission to interact with proxies or Alerts permissions to retrieve data from alerts.|
You can now grant or revoke permissions, which is the same for user accounts and service accounts, and you can deactivate or activate a service account.
Deactivate or Activate a Service Account
You can temporarily (or permanently) deactivate a service account. When an account is deactivated, none of the corresponding tokens work.
You can activate or deactivate a service account from the Service Accounts page or from the Edit Service Account page.
To activate or deactivate an account from the Service Accounts page:
To activate or deactivate an account from the Edit Service Account page: