AWS credential retrieval use cases - You can retrieve AWS credentials for these use cases: bootstrap, system, auto-login, and automation.

Retrieve Control Room bootstrap credentials for AWS

Note: This use case applies to On-Premises deployments only.

The Automation 360 Control Room uses bootstrap credentials to access supporting services such as database, service account, and Active Directory (AD). You configure these credentials during the initial On-Premises installation or post-installation (using the key vault utility) by specifying the object name.

The following image shows the process of retrieving the Control Room bootstrap credentials with AWS:

AWS Control Room bootstrap credential retrieval

When required during the bootup sequence or normal operations (such as refreshing a service authentication), the Control Room uses the key vault connection to retrieve the credential and perform the required authentication.

Note: You must select the Microsoft SQL Server Authentication for this use case; other database authentication methods are not supported for bootstrap.

Retrieve Control Room system credentials for AWS

Note: This use case applies to On-Premises deployments only, and you can configure the service account only during the initial installation.

If you configured an external key vault during the initial installation, you can then use the Automation 360 user interface (post-installation) to configure SMTP and Active Directory (AD) credentials.

Log in to the Automation 360 Control Room as the Administrator.
From the Control Room, navigate to: Administration > Settings > Email Settings.
You can map the AD primary account credential from the external key vault, configure external credentials, or set to manual (switch modes of AD primary account credential retrieval).

Retrieve auto-login credentials

Note: This use case applies to both On-Premises and Cloud deployments.

Auto-login credentials are used to authenticate to an Automation 360 Bot Agent device and start an active Windows session. Automation requires an active Windows session to function. Auto-login occurs prior to the automation running when automation is launched from a remote Bot Agent device.

The following image shows the process of retrieving the auto-login credentials with AWS:

AWS retrieve auto-login credentials

A Control Room administrator can manually launch or schedule a job to launch an automation on a Bot Agent device by specifying these details:

Automation (bot) name
Device name
User context

The system performs auto-login to the specified device with the user name and password associated with the user context, and then runs the automation on the device.

You must have a secret for each Control Room user for whom the auto-login credentials will be retrieved from the external key vault, and the secret name in the AWS Secrets Manager must match the Control Room username.

Note: In Automation 360 v.41 and later, device auto-login configuration is available through only one of the following paths, depending on the features enabled for your environment:

If the Manage > External Vault option is visible, configure device auto-login using this flow. This flow supports configuring auto-login for a selected external vault connection in environments that use one or more external vaults. See Option A: Auto-login under Manage given below.
If not, configure device auto-login using Administration > Settings > External key vault > Device auto login. See Option B: Auto-login under Settings given below.

Option A: Auto-login under Manage

Enable the device auto login settings to retrieve auto-login credentials from the AWS Secrets Manager and map the Control Room username with the secret name:

Note: In a multi-vault setup, each user account with unattended Bot Runner license can be mapped to only one vault connection where its credentials are stored. If no explicit mapping exists, the system checks for a connection with Automation 360 naming enabled or an updated connection. If neither is found, it falls back to device credentials. Ensure that each user account with Bot Runner license is mapped to the correct vault connection.

Log in to the Automation 360 Control Room with View external vault and Manage external vault permission.
Click Add Auto login, Add or + icon.
From the Select vault drop-down list, choose one of your vault connections of AWS provider.
Under Auto login, Enabled is selected by default. Click Disabled if you want to disable auto login for this vault connection.
Note: If auto-login is disabled for this vault connection:
- The Secret naming convention configuration option will not be available.
- If a user account with an unattended Bot Runner license is mapped to this external vault connection, credentials are retrieved using the device Credential Vault and its stored credentials instead.
Under Secret naming, select one of the following options: Custom or System (A360).
Custom: If you've selected this option, do the following
1. Click Next to open the Secret mapping page.
2. You can manage secret mappings in two ways - single entry or bulk entries.
  Single entry: Use this method to add a mapping directly in the custom secrets mapping table, without needing a CSV upload.
  1. Click + icon on top of the Secret mappings table.
  2. Enter the Username and Secret name.
  3. Click Add.
    Note: The system validates whether the entered username exists in the Control Room. If the username does not exist, an error is displayed and the entry is not saved.
  Bulk entries: Use this method to add multiple mappings simultaneously by importing a .CSV template file containing username and secret names mapping entries into the Control Room. You can also use this method for single-entry updates.
  1. Download the Custom Secrets Name Mapping Template.csv template and add the username, secret name in the format specified.
    Note: In the Automation 360 On-Premises deployments with Active Directory, prefix the username with domain. Example: domain\username.
  2. Click Import .csv.
  3. Browse to select the Custom Secrets Name Mapping Template.csv template file to map the Control Room usernames with the secret names.
    The imported Import .csv template must follow the specified format. You cannot use the exported mapping entries in Import .csv file to import new entries.
  4. Click Import and save. The custom secrets mapping table is populated with the updated entries.
  5. Click Close to return to the list of auto-logins created.
System (A360): If you've selected this option, click Create Auto Login and skip the steps above for importing the CSV file. The system automatically looks up secrets based on the Automation 360 naming convention. See Auto-login naming conventions.
Note:
- You can optionally complete the secret mapping steps given above under the Custom option if you plan to switch to the Custom naming convention in the future.
- System (A360) supports only one auto-login configuration. For all new external vault connections, use the Custom option.

Option B: Auto-login under Settings

Note: Use this option only if Manage > External Vault path is not visible.

Task 1: Map the Control Room username with the secret name

Log in to the Automation 360 Control Room with View external vault and Manage external vault permission.
Navigate to Administration > Settings > External key vault > Device auto login.
Click Edit.
Under Configure secrets name, select one of the following: Automation 360 defined secrets naming or Custom secrets naming.
Automation 360 defined secrets naming: If you've selected this option, click Save changes and skip the below steps for importing the CSV file. The system automatically looks up secrets based on the Automation 360 naming convention. See External key vault naming conventions.
Note: You can optionally complete the secret mapping steps given below under the Custom secrets naming option if you plan to switch to the Custom secrets naming convention in the future.
Custom secrets naming: If you've selected this option, do the following:
1. Select Manage custom secrets mappings.
2. Download the Custom Secrets Name Mapping Template.csv template and add the username, secret name in the format specified.
  Note: In the Automation 360 On-Premises deployments with Active Directory, prefix the username with domain. Example: domain\username.
3. Click Import .csv and browse to select the Custom Secrets Name Mapping Template.csv template file to map the Control Room usernames with the secret names.
  The import Import .csv template must follow the specified format. You cannot use the exported mapping entries Import .csv file to import new entries.
4. Click Import and save. The custom secrets mapping table is populated with the updated entries.
  You can now perform the following actions, as necessary:
  - Search bar to search and sort by secret name.
  - Import .csv to add or update the entries.
  - Export to .csv to export the mapped entries into a .csv format.
  - Delete checked items to remove multiple entries.
  - Refresh to refresh the updated entries.

Task 2: Enable device auto-login from AWS Secrets Manager

After mapping the Control Room usernames with secret names, you can enable the device auto login settings to retrieve auto-login credentials from the AWS Secrets Manager, using the following procedure:

Note: You cannot enable auto-login for specific unattended Bot Runners by providing device credentials for them. Once key vault is configured, credentials for all unattended Bot Runners will be retrieved from the key vault. Make sure that each Bot Runner’s credentials are stored in the key vault to avoid a Secret not found error.

Navigate to Administration > Settings > External key vault > Device auto login
Click Edit.
Click Enabled to retrieve the auto-login credentials from that external key vault.
If this option is disabled, then the external key vault connection was not configured.
Note: If you disable auto-login from the external key vault, then credentials are retrieved using the AAI Credential Vault and its stored credentials instead.
Click Save changes.

Auto-login naming conventions

If you selected the System (A360) under Secret naming, follow the auto-login naming convention described below.

system naming convention selected

The Control Room retrieves auto-login credentials based on the object naming convention within the external key vault. The Control Room searches for an object where the object name (the credential name in the external key vault) matches the Control Room username for which it is performing auto-login.

The prefix autologin_ is required if System (A360) naming convention is selected for AWS key vault. The name of the auto-login credential in the external key vault must contain autologin_ followed by the Control Room username. In some cases, certain key vaults have restrictions on the characters that can be used in credential object names. Additionally, to support how different use cases encode credentials, Automation 360 requires that certain characters be reserved or encoded.

The following table lists examples of the object naming conventions expected in the Control Room:


Control Room username	Expected object name format
ABCD\user123	autologin_ABCD--user123
user123@rpa.abcd.com	autologin_user123-40-rpa-2e-abcd-2e-com

Note: For On-Premises customers using AD authentication, you must format auto-login usernames using the UPN format or domain\username postfix.

For auto-login credentials, keep these in mind:

The object name in the external key vault must contain autologin_ as a prefix.
The auto-login credential names must map to the Control Room username (login ID) for the credential being retrieved.
Some external key vaults have usage restrictions of certain characters, such as backslash (\) and ampersand (@) in the secret name (object name), and restrictions on how special characters are interpreted within API calls. If the user ID contains special characters, then you must encode the secret name (object name) in the external key vault using ASCII code character substitutions, as listed in the following table.


This character	Changes to this ASCII code character substitution
\ (backslash)	--
- (dash)	-2d-
_ (underscore)	-5f-
@ (ampersand)	-40-
. (period)	-2e-

Note: Except for the backslash being mapped to double dashes, the dash, period, underscore, and ampersand are mapped using their ASCII code bracketed in dashes.

AWS auto-login credential example

For this auto-login credential retrieval example, consider a Control Room user who wants to deploy a bot on a device as a specific user. This example uses the following details:

Automation (bot) name run on a device = ProcureToPayGeoEast
Agent device name = WinVDI1138
Agent user context = rpauserCR1@abcd.com

The following image illustrates example of retrieving auto-login credentials with AWS:

AWS retrieve auto-login credentials

Before starting the automation, ensure the following:

The Control Room connection details have been successfully configured, and the Control Room uses these connection details to connect to AWS and performs authentication.
The Control Room queries the Bot Agent device running on device WinVDI1138 to check if there is an active Windows (operating system) session currently on device WinVDI1138, and if that session belongs to Agent user rpauserCR1.
If there is an existing session on the device for user rpauserCR1, then there is no need to perform auto-login and the bot continues with the deployment.
However, if there is an no active session or if there is an active session that does not belong to rpauserCR1, then the Control Room retrieves the auto-login credential from the AWS Secrets Manager.
The Control Room passes the credential (username and password) to the Bot Agent. The Bot Agent performs a Windows login on device WinVDI1138 as rpauserCR1 (first, logging off any other user login session) using the auto-login credential for rpauserCR1. The automation (Bot) ProcureToPayGeoEast then starts to run on device WinVDI1138 as rpauserCR1.

Retrieve automation credentials

Note: This use case applies to both On-Premises and Cloud deployments.

Automation credentials are variables used by bot developers within automation (bot) actions that define and retrieve data from encrypted storage. The automation uses the credentials to authenticate to applications (for example: finance application). Automation credentials are retrieved by the Automation 360 Bot Agent during runtime.

The following image shows the process of retrieving automation credentials with AWS:

AWS retrieving automation credentials

Automation credentials retrieved from the AWS Secrets Manager are mapped in the Automation Anywhere Credential Vault. The Credential Vault supports these two types of automation credentials:

System credentials: Credentials where the value returned by the credential variable is the same for any automation that uses that variable.
User-defined credentials: Credentials where the value returned by the credential variable is distinct based on the user context in which the automation is running.

For both system credentials and user-defined credentials, the bot developer specifies the same credential variable within the bot code. Then, the system determines which credential to retrieve during bot runtime.

User-defined credentials simplify automation development by enabling bot developers to write code using a single credential variable where the RPA platform substitutes the value returned during runtime with a unique user-specific value. Developers can avoid writing duplicate code with different user-specific credential variables.

The following image shows the expected naming convention for AWS credentials:

AWS expected credentials

The diagram shows six secrets in the AWS Secrets Manager which can be mapped to two credentials within the Control Room Credential Vault

Object3
Object4

For example, you can map a locker in the Control Room to either prefixID3 or prefixID4. Then, you map the secret to a credential. For each credential, the secrets will be consumed (retrieved by the Control Room) as a system-defined credential (without username postfix) and two user-defined credentials (one each for the Control Room users whose usernames are User1ID1 and User1ID2).

Note: Within the Control Room Credential Vault, the name of the locker and the name of the credential are arbitrary and local to the Control Room. You map these names to specific secrets in the external key vault.

Within AWS Secrets Manager, each automation credential is stored with a name that contains specific identifiers including: a prefix, object identifier, and an optional postfix which identifies a username. This is a required naming convention that assures retrieval of the correct credential. The name of the secret (the credential) in AWS Secrets Manager encodes information about the mapping within the Automation Anywhere Credential Vault.

As an administrator, to map a Control Room to AWS Secrets Manager, you create and configure a locker and a credential using the external key vault option within the Create Locker and Create Credential features in the Automation 360 Control Room:

You configure lockers in the Credential Vault that map to an AWS secret name prefix.
You configure credentials in the Credential Vault that map to an AWS secret object identifier (optional postfix for user-defined credential).

During runtime, the RPA platform retrieves the secret that is named with a postfix that matches the user context (user-defined credential) in which the automation is running. If there is no user-defined credential, then the RPA platform retrieves the secret without a username postfix (system credential).

The Control Room implements access controls to the external credentials through permissions within roles. You control access to credentials by assigning different Control Room users to different roles and then associating different lockers with those roles.

The following image shows the Control Room Credential Vault locker and credential mapped to an AWS secret:

AWS mapped credentials to Credential Vault

Important: When creating an externally mapped credential, you must place the credential in the appropriate externally mapped locker (the locker is mapped to the prefix in the secret name). The AWS secret name will have a naming convention: Prefix + Secret_Name_Body + Postfix (optional for user-defined credentials).

Note: The same permissions and privileges (assigned through roles) in the Control Room apply to credentials mapped to the external key vault.

Automation naming conventions

The following table shows AWS Secrets Manager external key vault examples using naming conventions for automation.

Note: The AWS Prefix maps to the locker for the Control Room, and the AWS Secret Body maps to the credential for the Control Room.


Automation credential example	AWS Prefix	AWS Secret Body	Secret in AWS	Control Room username
accounting_pdf System credential in locker mapped to AWS Secret name prefix accounting	accounting	pdf	accounting_pdf (system)	None - system credential
accounting_pdf_ABCD--user123 User-defined credential in locker mapped to AWS Secret Name prefix accounting	accounting	pdf	accounting_pdf_ABCD--user123	ABCD\user123

AWS automation credentials retrieval procedure

To configure automation credentials retrieval and integrate with the AWS Secrets Manager, you first create a locker and then create credentials.

Note: If you want to store credentials in the Control Room credential vaults and external key vaults, do the following:

Create separate lockers in the Control Room to store credentials created in the Control Room credential vaults.
Create separate lockers in the Control Room to store credentials created in external key vaults.

The Control Room does not support storing credentials from the Control Room credential vaults and external key vaults in the same locker.

In Automation 360 v.41 and later, credential and locker management for external vaults are available through either of the following options, depending on the features enabled for your environment.

If the Manage > External Vault option is visible, use this flow for all external vault related activities, including creating and managing lockers and credentials. This flow is designed for environments that use one or more external vaults. See:
- Manage lockers for an external key vault connection
- Manage credentials for an external key vault connection
If not, use the Manage > Credentials flow to create lockers and credentials. See:
- Create locker
- Create credential

Note: When Manage > External Vault is visible, the Manage > Credentials option remains visible too. However, external vault related credential and locker creation options are no longer available through the Manage > Credentials flow.

AWS Secrets Manager automation object naming example

The following table shows AWS external key vault object naming examples using naming conventions for automation.

Note: The AWS Secret Name Prefix maps to the locker for the Control Room, and the AWS Secret Body maps to the credential for the Control Room.


Automation credential example	Control Room username	AWS Prefix	AWS Secret Body	Secret in AWS
accounting_pdf System credential in locker mapped to AWS Secret Name prefix accounting	None - system credential	accounting	pdf	accounting_pdf (system)
accounting_pdf_ABCD--user123 User-defined credential in locker mapped to AWS Secret Name prefix accounting	ABCD\user123	accounting	pdf	accounting_pdf_ABCD--user123