External Vaults
The External Vault feature enables DCM to integrate with your preferred third-party vault, such as HashiCorp Vault or AWZ Secrets Manager. This allows DCM to securely retrieve credentials from your vault when needed, eliminating the need to copy or store those credentials in DCM.
Currently, DCM on Designer and Alteryx One supports AWS Secrets Manager, CyberArk Conjur, and HashiCorp Vault.
External Vaults in Designer
To configure External Vaults, DCM must be enabled. To connect DCM to your Vault:
In Designer, select File > Manage Connections to open DCM.
Go to the External Vaults tab.
Choose +New.
Enter a vault name and choose a technology.
Enter the address of your Vault into the URL input, for example,
https://myvault.hashicorp.cloud:8200/.Select Save.
Choose an Authentication Method.
Fill in the credential information and select Link.
You can now select this External Vault as a source of credentials.
Create an External Vault Credential
To create a new credential that contains authentication data from an External Vault, you must:
Open DCM > Connections tab.
Select + New Connection.
Enter the connection name.
Select Vault from the Vault dropdown.
Enter a path to the secret in the selected Vault into the Vault Path. Use slash formatting, for example,
path/to/secret.Select Authentication method.
If you want to fetch the credential from Vault, check the Use Values from Vault check box.
Then enter the key - the username (when accessing a key-value type of secret) or the JSON path (if the retrieved secret is a more complex JSON object) using the JavaScript object notation, for example,
secrets.username.Other types of secrets are not supported.
Select Save.
Now, the newly saved credential can be used in your Workflow, just like any other DCM credential.
Note
External vault credentials are not stored persistently by Alteryx. DCM stores only a reference to the credential in the external vault. At workflow runtime, DCM retrieves the credential payload from the vault, uses it to establish the connection, and discards the payload after the workflow completes.
Edit or Delete External Vault Credential
To edit or delete external vault credential...
Open DCM > Credentials tab.
Select the credential that you want to edit or delete.
To edit: Select Edit, update the credential details, and select Save.
To delete: Select the trashcan icon and select Delete to confirm.
External Vaults in Alteryx One
To configure external vaults in Alteryx One...
In the Alteryx One home page, select Data > Connections tab.
Select +New Connection and choose the vault.
Enter the connection name and the data source details.
Select Vault from the Vault dropdown.
Enter a path to the secret in the selected Vault into the Vault Path.
Select the Authentication method.
If you want to fetch the credential from Vault, check the Use Values from Vault check box.
Then enter the key - the username (when accessing a key-value type of secret) or the JSON path (if the retrieved secret is a more complex JSON object) using the JavaScript object notation, for example,
secrets.username.Other types of secrets are not supported.
Select Save.
Note
Generic and custom vault support is not included in this release of Workspace Execution.
Edit or Delete External Vault
To edit or delete external vault...
In the Alteryx One home page, select Data > External Vaults tab.
Select the vault that you want to edit or delete.
To edit: Select Edit, update the vault details, and select Save.
To delete: Select the trashcan icon and select Delete to confirm.