Workflows
What are Access Workflows?
Workflows are used in Common Fate to inform the policy engine how long access should last. Workflows connect with other resources like availabilities and Slack alerts.
Creating an Access Workflow
Access workflows are created using the commonfate_access_workflow
resource in Terraform.
The priority
governs whether the policy will be used. If a different policy with a higher priority and the same role exists that one will be used over another.
Specifying an activation expiry
Common Fate can be configured to automatically close approved requests if they are not activated within a particular duration. To configure an activation expiry, set the activation_expiry
variable in the Access Workflow:
The activation_expiry
cause requests to expire if they are approved but not activated for a specified amount of time.
In the example above any requests approved but not activated after 8 hours will be closed, requiring the user to re-request access.
Requiring a reason on Access Requests
To require a reason on Access Requests for a particular workflow, you can specify the validation
variable on the Access Workflow:
Validating the reason on Access Requests
To require add validation to the reason on Access Requests for a particular workflow, you can specify the validation
variable on the Access Workflow:
Make sure to double escape any backslash characters by using \
. In the example above, the regex \d+
needs to be escaped like \\d+
so that Terraform is able to read the string.
Specifying a default duration for Access Requests
The Common Fate web console and CLI will default to the maximum duration when requesting access. You can change the default duration by providing the default_duration_seconds
variable on the Access Workflow:
Enabling Access Request Extensions
By default, the Common Fate web console will not allow extensions if the extension_conditions
configuration is not specified on the Access Workflow.
The maximum_number_of_extensions
parameter sets the number of times an Access Request can be extended. This can be set to 0, effectively disabling extensions.
The extension_duration_seconds
parameter defines the duration, in seconds, that the Access Request will be extended by.
Extensions can only be requested after at least 50% of the duration has elapsed. This ensures that extensions are used judiciously and not immediately after access is granted.
For example, with an initial access duration of 60 minutes:
- You must wait at least 30 minutes (50% of the initial duration) before requesting your first extension.
- If you extend when you have 25 minutes remaining, your access will be extended to 35 minutes.
- You can request a second extension after another 5 minutes (50% of the extension duration) has elapsed.
- With a maximum of two extensions, you can add up to 20 minutes to your initial access duration.
This approach ensures that extensions are used thoughtfully and only when necessary.