Just-In-Time (JIT) access to roles
Granted can be used with Common Fate for just-in-time access to privileged AWS roles.
Prerequisites
For this recipe, you’ll need a Common Fate deployment. Email us or message us on Slack to arrange a Common Fate licence key for a proof-of-concept deployment.
You’ll also need Granted v0.23.0 or later installed.
You can use Granted to request just-in-time access to roles. Internally, we use AWS credential_process to source credentials through Granted.
You will need to update each role you want to request access to with the following configuration:
- [profile my-profile]
- sso_account_id = <your-sso-account-id>
- sso_region = <your-sso-region>
- sso_role_name = <your-role-name>
- sso_start_url = <https://example.awsapps.com/start>
+ [profile updated-profile]
+ granted_sso_account_id = <your-sso-account-id>
+ granted_sso_region = <your-sso-region>
+ granted_sso_role_name = <your-role-name>
+ granted_sso_start_url = <https://example.awsapps.com/start>
+ credential_process = granted credential-process --profile updated-profile
+ common_fate_url = https://commonfate.example.com # the URL of your Common Fate deployment
Providing the common_fate_url is optional. If it is not provided, Granted will look up the Common Fate API URL from the Common Fate TOML config file.
Now, try assuming a profile that you don’t currently have access to. For example:
> assume production-access-role
You should see an output similar to the below, depending on the authorization policies you’ve configured in Common Fate.
> assume production-access-role
[i] You don't currently have access to production-access-role, checking if we can request access... [target=AWS::Account::"123456789012", role=AWSAdministratorAccess, url=https://commonfate.example.com]
[WILL ACTIVATE] AWSAdministratorAccess access to Sandbox-2 will be activated for 2h: https://commonfate.example.com/access/requests/req_2eoefaC9KCuIiOAZ541JsOlU97t
[i] Access::Grant::"gra_2eoefkXzQap0kjm6O8fzrLwUbaz": Access is automatically approved because you are on-call in PagerDuty
? Apply proposed access changes (y/N)