Create Bundles

Learn how to group integrations, roles, resources, and access scopes together from the Apono UI

Bundles allow admins to manage access to integrations, roles, resources, and access scopes by grouping them together.

Bundles offer you the following benefits:

• Streamline the access request process for users

• Integrate easily with existing access flows

• Minimize administrative overhead through centralized management

---

Prerequisite

Item	Description
Cloud Resources	One or more resources in a cloud platform that has been integrated with Apono If you have not already, integrate Apono with a cloud platform to control access to its resources: AWS integrations Azure integrations GCP integrations Kubernetes integrations

---

Create a bundle

Create Bundle page

Follow these steps to create a bundle from the Apono admin portal:

1. On the Bundles page, click Create Bundle. The Create Bundle page appears.

If Space Management is enabled, select a space from the space selector at the top of the page to create a space-specific bundle.

If no space is selected, the bundle will be created at the global account level.

1. Enter a Bundle name.

This name will identify the bundle on the Bundles page and when creating access flows.

1. Define the bundle.

Resources

Follow these steps to select the resources:

1. Click Basic.

2. Filter the resources by one or more of the following filters. Resources matching the selected filters display.

To create complex queries, click AQL to build a query in the code box.

The Apono Query Language enables you to extend your query capabilities beyond the standard options available with the UI.

Integration

Follow these steps to filter by integration:

1. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

2. (Optional) In the Search field, enter a value to filter the list of integrations.

3. Select one or more integrations. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Resource Type

Follow these steps to filter by resource type:

1. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

2. (Optional) In the Search field, enter a value to filter the list of resource types.

3. Select one or more resource types. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Resource Name

Follow these steps to filter by resource name:

1. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

2. (Optional) In the Search field, enter a value to filter the list of resource names.

3. (Equals, Not Equals only) Select one or more resource names. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Permission Name

Follow these steps to filter by permission name:

1. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

2. (Optional) In the Search field, enter a value to filter the list of resource names

3. (Equals, Not Equals only) Select one or more permission names. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Resource Path

Follow these steps to filter by resource path:

1. Click (More filters icon) > Resource Path.

2. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

3. (Optional) In the Search field, enter a value to filter the list of resource paths.

4. Select one or more resource paths. Only the values meeting the criteria will be shown.

5. Click outside of the menu to close it.

Resource Source ID

Follow these steps to filter by resource source ID (for example, account, folder, project, Azure subscription, or management group IDs):

1. Click (More filters icon) > Resource Source ID.

2. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • In (in)

   • Not (not in)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

3. (Optional) In the Search field, enter a value to filter the list of IDs.

4. Select one or more IDs. Only the values meeting the criteria will be shown.

5. Click outside of the menu to close it.

Resource Tag

Follow these steps to filter by resource tag:

1. Click (More filters icon) > Resource Tag.

2. (Optional) In the Search field, enter a value to filter the list of resource names.

3. Click the resource name.

4. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

5. (Optional) In the Search field, enter a value to filter the list of resource tags.

6. (Equals, Not Equals only) Select one or more resource tags. Only the values meeting the criteria will be shown.

7. Click outside of the menu to close it.

Resource Risk Level

Follow these steps to filter by resource risk level:

1. Click (More filters icon) > Resource Risk Level.

2. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

3. Select one or more resource risk levels. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Permission Risk Level

Follow these steps to filter by permission risk level:

1. Click (More filters icon) > Permission Risk Level.

2. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

3. Select one or more pemission risk level. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

1. Click Select Resources to create the bundle.

Access Scope

Follow these steps to select a specific access scope:

1. Click More Options > Access Scope. The Select access scope menu appears.

2. (Optional) Enter keywords into the search bar to locate an access scope.

3. (Optional) Click (eye icon). A Preview Access Scope pop-up window appears displaying the contents of the access scope.

4. Select an access scope.

You can also click + Create New Access Scope if none of the existing access scopes meet your needs. The Inventory page appears. You can create and use the new access scope.

Integrations

Follow these steps to select a specific integration:

1. Click More Options > Integrations. The Select integration menu appears.

2. (Optional) Enter keywords into the search bar to locate an integration.

3. Select an integration. The Select resource type panel appears.

4. Select the resource type.

5. Click Done. The panel closes.

6. Click permissions. The Permissions menu appears.

7. Select one or more permissions to grant the requester.

8. Click outside the window to close it.

9. (Optional) Refine the available resources:

   1. Click in the populated to field. A list of resources appears.

   2. Select one or more resources.

By default, the user has access to Any resources. However, the following options allow you to define access more granularly:

• Any resources except specific

• Select by name

• Select by tags

1. (Optional) Click + Add Resources and repeat step 3 to include another resource.

2. Enter a Description that explains the purpose of the bundle. This description appears on the Bundles list page and when the bundle is displayed while building an access flow.

A description can be generated after defining the name and resources.

Follow these steps to generate a definition:

1. Click Generate. Apono will populate the field with a new description.

2. (Optional) Review and manually edit the description.

1. Click Save Bundle. The new bundle appears on the Bundles page.

After creating a bundle, you can add the bundle to an access flow.

---

Comparative Logic

The following tables explain the filter comparative logic.

Logic	Description
Equals (=)	Checks if values are the same Examples: Resource Type equals DynamoDB Table Resource Status equals ACTIVE After filtering by this value, you can select the exact resources to include in your filtered query.
Not Equals (!=)	Checks if values are different Examples: Integration does not equal AWS Playground Resource Type does not equal S3 Bucket After filtering by this value, you can select the exact resources to include in your filtered query.
Contains (a*b)	Checks if a value contains another value as a substring or pattern Examples: Resource Name contains playground Resource Tag contains true
Does not contain (!a*b)	Checks if a value does NOT contain another value as a substring or pattern Examples: Resource Name does not contain production Permission Name does not contain admin
Starts with (*b)	Checks if a value begins with a specific value or pattern Examples: Resource Name starts with aws Resource Tag for a region starts with eu
Ends with (a*)	Checks if a value ends with a specific value or pattern Examples: Resource Name ends with terraform-state Resource Tag for an env ends with dev

---

Add a bundle to an access flow

After creating a bundle, you can incorporate the bundle into an access flow to streamline access requests.

Follow these steps to add a bundle to an access flow:

1. Define the permitted requesters for the bundle ( Self Serve | Automatic ).

2. Define access to the bundle ( Self Serve | Automatic ).

3. (Self Serve only) Set the access duration of the bundle.

4. Click Create Access Flow (Self Serve) or Review and Create > Create and Grant (Automatic).

After adding the bundle to an access flow, end users will be able to request access to the bundle in Slack, Teams, CLI, or the Apono User Portal .