# Automatic Access Flows

To create an automatic access flow, you must define the permitted users and available resources.

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-786be46284952e24344dbc18c43edc8daa575656%2Faccess-flow-automatic.png?alt=media" alt="" width="563"><figcaption><p><em>Create Access Flow page</em></p></figcaption></figure>

***

### Prerequisites

<table><thead><tr><th width="158">Item</th><th>Description</th></tr></thead><tbody><tr><td><strong>Cloud resources</strong></td><td><p>One or more resources in a cloud platform that has been integrated with Apono<br><br>If you have not already, integrate Apono with a cloud platform to control access to its resources:</p><ul><li><a href="../../aws-environment/aws-integrations">AWS integrations</a></li><li><a href="../../azure-environment/azure-integrations">Azure integrations</a></li><li><a href="../../gcp-environment/gcp-integrations">GCP integrations</a></li><li><a href="../../kubernetes-environment/kubernetes-integrations">Kubernetes integrations</a></li></ul></td></tr><tr><td><strong>Apono identities</strong></td><td><p>One or more identity sources in the Apono system<br><br>There are various ways to add identities to Apono:</p><ul><li><a href="../../additional-integrations/identity-providers">Integrate an identity provider</a></li><li><a href="../../../user-administration/create-identities#add-a-user">Invite a user manually</a></li></ul></td></tr></tbody></table>

***

### Define permitted users

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-d0a9692a496cdbdfd14e9378ad912a1c0d889d16%2Faccess-flow-automatic-permitted-users.png?alt=media" alt="" width="563"><figcaption><p>Defining grantees</p></figcaption></figure>

Follow these steps to define the permitted grantees:

1. On the [**Access Flows**](https://app.apono.io/access-flows) page, click **Create Access Flow**. The **Create Access Flow** page appears.

{% hint style="success" %}
If [Space Management](https://docs.apono.io/docs/user-administration/space-management) is enabled, select a space from the space selector at the top of the page to create a space-specific access flow.

If no space is selected, the access flow will be created at the global account level.
{% endhint %}

1. Click **Automatic**. The **Automatic** fields appear below.
2. Enter an alphanumeric, user-friendly **Access flow name**.
3. Click **Select attribute** to select an IdP attribute, such as **User** or **Group**.
4. (Optional) Click **is** to select conditional logic from the menu options.

{% hint style="info" %}
Other operators include the following:

* **Is not**
* **Contains**
* **Does not contain**
* **Starts with**
  {% endhint %}

7. Click **Select value** to select one or multiple users or groups from the menu options. This selection determines who is permitted to request access.
8. (Optional) Add another user.
   1. Under the last listed requestor, click **+**. A new row appears.
   2. Repeat steps **3-7**.
   3. Select the conditional logic for the multiple requestors.

      <table><thead><tr><th width="141">Condition</th><th>Description</th></tr></thead><tbody><tr><td><strong>AND</strong></td><td>(Default) Allows the user to request access if they meet <strong>all</strong> the attributes of the user group</td></tr><tr><td><strong>OR</strong></td><td>Allows the user to request access if they meet <strong>any</strong> of the attributes of the user group</td></tr></tbody></table>

***

### Define the resource

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-3b2cad7cac30e35101292392e2de0e7a48b9dd6e%2Faccess-flow-automatic-define-resource.png?alt=media" alt="" width="563"><figcaption><p>Defining resources</p></figcaption></figure>

You can define access to specific resources in an Apono integration, bundle, or access scope.

{% hint style="info" %}
If you are creating an access flow within a space, **only space-specific access scopes or bundles** can be used to define the access flow’s resources.
{% endhint %}

{% tabs %}
{% tab title="Integrations" %}
{% hint style="success" %}
To ensure you do not exceed the AWS inline policy character limit, read [AWS Limitations](https://docs.apono.io/docs/aws-environment/aws-integrations/integrate-an-aws-account-or-organization/aws-best-practices) when adding AWS resources.
{% endhint %}

Follow these steps to define access to specific resources:

1. Under **They will have access to**, click **Select target > Integrations**.
2. Select an integration. The **Select resource type** panel appears.
3. Select the resource type.
4. Click **Done**. The panel closes.
5. Click **permissions**. The **Permissions** menu appears.
6. Select one or more permissions to grant the requester.
7. (Optional) Refine the available resources:
   1. Click in the populated **to** field. A list of resources appears.
   2. Select one or several resources.

{% hint style="info" %}
By default, the user has access to **Any resources**. However, the following options allow you to define access more granularly:

* **Any resources except specific**
* **Select by name**
* **Select by tags**
  {% endhint %}

8. (Optional) Add another target:
   1. Click **+** at the end of the row. A new target row appears.
   2. Repeat steps **1-7** or add a [bundle](#bundles) or [access scope](#access-scope).
      {% endtab %}

{% tab title="Bundles" %}
{% hint style="success" %}
To ensure you do not exceed the AWS inline policy character limit, read [AWS Limitations](https://docs.apono.io/docs/aws-environment/aws-integrations/integrate-an-aws-account-or-organization/aws-best-practices) when adding bundles with AWS resources.
{% endhint %}

Follow these steps to define access to a specific bundle:

1. Under **They will have access to**, click **Select target > Bundles**.
2. Select a bundle.
3. (Optional) To add another bundle, click **+**. A new target row appears.
4. Repeat steps **1-2** or add an [integration](#integrations) or [access scope](#access-scope).
   {% endtab %}

{% tab title="Access Scope" %}
Follow these steps to define access to a specific access scope:

1. Under **They will have access to**, click **Select target > Access Scope**. The **Select access scope** menu appears.

{% hint style="success" %}
You may enter keywords into the search bar to locate an access scope.
{% endhint %}

2. (Optional) Click <img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXf6tv7vrABRqb_3sHCQCkp-gGx-9GBQoWehtQXr2GjwUAv4jEwSuTan9BsckFs_R3hKm1zWb86-4gCVU2AUtQspUPRizHDEtlXAPc1m_OyItAOugW6buj8hpUTBGTjgccmKsyn-tQ?key=A4EZtKjLdP_MEnXmQA_WQ-Ky" alt="" data-size="line"> (eye icon) to preview the contents of the access scope in a popup window.
3. Select an access scope.

{% hint style="success" %}
You can also click **+ Create New Access Scope** if none of the existing access scopes meet your needs. The **Inventory** page appears. You can [create](https://docs.apono.io/docs/inventory/access-scopes#create-an-access-scope) and [use](https://docs.apono.io/docs/inventory/access-scopes#use-an-access-scope) the new access scope.
{% endhint %}

3. (Optional) To add another access scope, click **+**. A new target row appears.
4. Repeat steps **1-3** or add an [integration](#integrations) or [bundle](#bundles).
   {% endtab %}
   {% endtabs %}

***

### Set access flow settings

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-f1a03ade6dc35f30f9cc1c8dd67e6a8b8151dae5%2Faccess-flow-automatic-settings-new.png?alt=media" alt="" width="278"><figcaption><p>Access flow settings</p></figcaption></figure>

<table><thead><tr><th width="204">Setting</th><th>Description</th></tr></thead><tbody><tr><td><strong>Access flow labels</strong></td><td><p>Identifies an access flow for streamlined organization and use</p><p>When assigned to an access flow, labels appear in the access flow tiles on the <a href="https://app.apono.io/access-flows"><strong>Access Flows</strong></a> page.</p><p>Follow these steps:</p><ol><li>Enter a value.</li><li>Press Enter on your keyboard or select an existing label from the filtered list.</li></ol></td></tr><tr><td><strong>Description</strong></td><td><p>Access flow summary automatically generated after defining the name, grantee, and resources</p><p>To keep the description aligned with changes in the access flow, click <strong>Generate</strong> to refresh it with the latest updates:</p><ol><li>Click <strong>Generate</strong>. Apono will populate the field with a new description.</li><li>(Optional) Review and manually edit the description.</li><li>(Optional) Provide feedback on the description. Click <img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-d868fa52ded73e3907fd4a933a7604a7ca609c7b%2Faccess-clarity-approve.png?alt=media" alt="" data-size="line"> (thumbs up icon) if the description was helpful. Click <img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-ca6382f453f0c527252bc69d4df55144f98992a5%2Faccess-clarity-disapprove.png?alt=media" alt="" data-size="line"> (thumbs down icon) and add a comment if the description was unhelpful.</li></ol></td></tr></tbody></table>

***

### Review the access flow

After defining the [permitted users](#define-permitted-users) and [resource](#define-the-resource), follow these steps to review and save an automatic access flow:

1. Click **Review and Create**. The **Automatic Access Flow Summary** appears.

{% hint style="info" %}
The access flow summary provides a visual overview of the relationship between the requesters and the target resource.
{% endhint %}

2. Click **Create and Grant**.