Automatic Access Flows
Automatic access flows automatically grant and revoke access to a resource based on user context. This access flow type is best used for role-based access control (RBAC) and on-call shift baselines.
To create an automatic access flow, you must define the permitted users and available resources.
Prerequisites
Cloud resources
One or more resources in a cloud platform that has been integrated with Apono If you have not already, integrate Apono with a cloud platform to control access to its resources:
Apono identities
One or more identity sources in the Apono system There are various ways to add identities to Apono:
Begin access flow creation
Follow these steps:
On the Access Flows page, click Create Access Flow. The Create Access Flow page appears.
If Space Management is enabled, select a space from the space selector at the top of the page to create a space-specific access flow.
If no space is selected, the access flow will be created at the global account level.
Click Automatic. The Automatic fields appear below.
Enter an alphanumeric, user-friendly Access flow name.
Define permitted users
Follow these steps to define the permitted grantees:
Click Select attribute to select an IdP attribute, such as User or Group.
(Optional) Click is to select comparative logic from the menu options.
Click Select value to select one or more users or groups from the menu options.
Click outside of the menu to close it.
(Optional) To add another attribute, click + under the last listed attribute. In the new row that appears, repeat steps 1-4.
If multiple attributes have been defined select the conditional logic for the multiple attributes.
Define the resource
Follow these steps:
Define access to specific resources.
Follow these steps to define access to specific resources:
Under They will have access to, click Resources. The filters options appear.
Click Basic.
Filter the resources by one or more of the following filters. Resources matching the selected filters display.
To create complex queries, click AQL to build a query in the code box.
The Apono Query Language enables you to extend your query capabilities beyond the standard options available with the UI.
Integration
Follow these steps to filter by integration:
From the dropdown menu, select the comparative logic:
Equals (=)
Not Equals (!=)
(Optional) In the Search field, enter a value to filter the list of integrations.
Select one or more integrations. Only the values meeting the criteria will be shown.
Click outside of the menu to close it.
Resource Type
Follow these steps to filter by resource type:
From the dropdown menu, select the comparative logic:
Equals (=)
Not Equals (!=)
(Optional) In the Search field, enter a value to filter the list of resource types.
Select one or more resource types. Only the values meeting the criteria will be shown.
Click outside of the menu to close it.
Resource Name
Follow these steps to filter by resource name:
From the dropdown menu, select the comparative logic:
Equals (=)
Not Equals (!=)
Contains (a*b)
Does not contain (!a*b)
Starts with (*b)
Ends with (a*)
(Optional) In the Search field, enter a value to filter the list of resource names.
(Equals, Not Equals only) Select one or more resource names. Only the values meeting the criteria will be shown.
Click outside of the menu to close it.
Permission Name
Follow these steps to filter by permission name:
From the dropdown menu, select the comparative logic:
Equals (=)
Not Equals (!=)
Contains (a*b)
Does not contain (!a*b)
Starts with (*b)
Ends with (a*)
(Optional) In the Search field, enter a value to filter the list of resource names
(Equals, Not Equals only) Select one or more permission names. Only the values meeting the criteria will be shown.
Click outside of the menu to close it.
Resource Path
Follow these steps to filter by resource path:
Click
(More filters icon) > Resource Path.From the dropdown menu, select the comparative logic:
Equals (=)
Not Equals (!=)
Contains (a*b)
Does not contain (!a*b)
Starts with (*b)
Ends with (a*)
(Optional) In the Search field, enter a value to filter the list of resource paths.
Select one or more resource paths. Only the values meeting the criteria will be shown.
Click outside of the menu to close it.
Resource Source ID
Follow these steps to filter by resource source ID (for example, account, folder, project, Azure subscription, or management group IDs):
Click
(More filters icon) > Resource Source ID.From the dropdown menu, select the comparative logic:
Equals (=)
Not Equals (!=)
In (in)
Not (not in)
Contains (a*b)
Does not contain (!a*b)
Starts with (*b)
Ends with (a*)
(Optional) In the Search field, enter a value to filter the list of IDs.
Select one or more IDs. Only the values meeting the criteria will be shown.
Click outside of the menu to close it.
Resource Tag
Follow these steps to filter by resource tag:
Click
(More filters icon) > Resource Tag.(Optional) In the Search field, enter a value to filter the list of resource names.
Click the resource name.
From the dropdown menu, select the comparative logic:
Equals (=)
Not Equals (!=)
Contains (a*b)
Does not contain (!a*b)
Starts with (*b)
Ends with (a*)
(Optional) In the Search field, enter a value to filter the list of resource tags.
(Equals, Not Equals only) Select one or more resource tags. Only the values meeting the criteria will be shown.
Click outside of the menu to close it.
Resource Risk Level
Follow these steps to filter by resource risk level:
Click
(More filters icon) > Resource Risk Level.From the dropdown menu, select the comparative logic:
Equals (=)
Not Equals (!=)
Select one or more resource risk levels. Only the values meeting the criteria will be shown.
Click outside of the menu to close it.
Permission Risk Level
Follow these steps to filter by permission risk level:
Click
(More filters icon) > Permission Risk Level.From the dropdown menu, select the comparative logic:
Equals (=)
Not Equals (!=)
Select one or more pemission risk level. Only the values meeting the criteria will be shown.
Click outside of the menu to close it.
Click Select Resources or Create Bundle to create a bundle within the flow from the filtered resources.
To ensure you do not exceed the AWS inline policy character limit, read AWS Limitations when adding bundles with AWS resources.
Follow these steps to define access to a specific bundle:
Under They will have access to, click Bundles. The list of bundles appears.
(Optional) In the search field, enter a partial or full bundle name to filter the list of bundles.
In the Bundles panel, select a bundle. The contents of the bundle logic appears in the AQL pane.
Click Select Bundle.
Follow these steps to define access to a specific access scope:
Under They will have access to, click More Options > Access Scope. The Select access scope menu appears.
(Optional) Enter keywords into the search bar to locate an access scope.
(Optional) Click
(eye icon). A Preview Access Scope pop-up window appears displaying the contents of the access scope.
Select an access scope.
Follow these steps to define access to specific resources:
Under They will have access to, click More Options > Integrations. The Select integration menu appears.
(Optional) Enter keywords into the search bar to locate an integration.
Select an integration. The Select resource type panel appears.
Select the resource type.
Click Done. The panel closes.
Click permissions. The Permissions menu appears.
Select one or more permissions to grant the requester.
Click outside the window to close it.
(Optional) Refine the available resources:
Click in the populated to field. A list of resources appears.
Select one or more resources.
By default, the user has access to Any resources. However, the following options allow you to define access more granularly:
Any resources except specific
Select by name
Select by tags
(Optional) Click + Add Resources and repeat step 1 to include another resource.
Set access flow settings
Access flow labels
Identifies an access flow for streamlined organization and use
When assigned to an access flow, labels appear in the access flow tiles on the Access Flows page.
Follow these steps:
Enter a value.
Press Enter on your keyboard or select an existing label from the filtered list.
Description
Access flow summary automatically generated after defining the name, grantee, and resources
To keep the description aligned with changes in the access flow, click Generate to refresh it with the latest updates:
Click Generate. Apono will populate the field with a new description.
(Optional) Review and manually edit the description.
(Optional) Provide feedback on the description. Click
(thumbs up icon) if the description was helpful. Click 
(thumbs down icon) and add a comment if the description was unhelpful.
Review the access flow
After defining the permitted users and resource, follow these steps to review and save an automatic access flow:
Click Review and Create. The Automatic Access Flow Summary appears.
The access flow summary provides a visual overview of the relationship between the requesters and the target resource.
Click Create and Grant.
Logic reference
Comparative Logic
The following tables explain the filter comparative logic.
Equals (=)
Checks if values are the same
Examples:
Resource Type equals DynamoDB Table
Resource Status equals ACTIVE
After filtering by this value, you can select the exact resources to include in your filtered query.
Not Equals (!=)
Checks if values are different
Examples:
Integration does not equal AWS Playground
Resource Type does not equal S3 Bucket
After filtering by this value, you can select the exact resources to include in your filtered query.
Contains (a*b)
Checks if a value contains another value as a substring or pattern
Examples:
Resource Name contains playground
Resource Tag contains true
Does not contain (!a*b)
Checks if a value does NOT contain another value as a substring or pattern
Examples:
Resource Name does not contain production
Permission Name does not contain admin
Starts with (*b)
Checks if a value begins with a specific value or pattern
Examples:
Resource Name starts with aws
Resource Tag for a region starts with eu
Ends with (a*)
Checks if a value ends with a specific value or pattern
Examples:
Resource Name ends with terraform-state
Resource Tag for an env ends with dev
Conditional logic
AND
(Default) Allows the user to request access if they meet all the selected attributes
OR
Allows the user to request access if they meet any of the selected attributes
Last updated
Was this helpful?