Self Serve Access Flows

Create automated access policies for users to request access self-serve

Self serve access flows grant access to a resource based on a user request for a defined time period.

This access flow type is best used for sensitive or highly regulated resources, such as access to production. It also suits just-in-time (JIT) or break-glass access cases.

To create a self-serve access flow, you must define the permitted requestors, available resources, and approvers.

Create Access Flow page

---

Prerequisites

Item	Description
Cloud resources	One or more resources in a cloud platform that has been integrated with Apono If you have not already, integrate Apono with a cloud platform to control access to its resources: AWS integrations Azure integrations GCP integrations Kubernetes integrations
Apono identities	One or more identity sources in the Apono system There are various ways to add identities to Apono: Integrate an identity provider Invite a user manually

---

Begin access flow creation

Top section of the Create Access Flow page

Follow these steps:

1. On the Access Flows page, click Create Access Flow. The Create Access Flow page appears.

If Space Management is enabled, select a space from the space selector at the top of the page to create a space-specific access flow.

If no space is selected, the access flow will be created at the global account level.

1. Click Self Serve. The Self Serve fields appear below.

2. Enter a user-friendly Access flow name.

---

Define permitted requestors

Defining permitted requestors

Follow these steps:

1. Click When. A settings window appears to set the access period.

2. Set the access period.

Always

(Default) Applies to the requester conditions at all times

Follow these steps:

1. Select Always.

2. Click outside of the window to close it.

Only on

Applies to the requester conditions during a specific time frame

Follow these steps:

1. Select Only on.

2. Select one or more days of the week.

3. In the From field, select a start time from the dropdown menu.

4. In the to field, select an end time from the dropdown menu.

5. Select a timezone from the dropdown menu.

6. Click outside of the window to close it.

1. Define the permitted requestor:

   1. Click Select attribute to select an attribute, such as User or Group.

   2. (Optional) Click is to select comparative logic from the menu options.

   3. Click Select value to select one or more users or groups from the menu options.

   4. Click outside of the menu to close it.

   5. (Optional) To add another attribute, click + under the last listed attribute. In the new row that appears, repeat steps 3a-d.

2. If multiple attributes have been defined in step 3, select the conditional logic for the multiple attributes.

---

Request access on behalf of others

This setting allows requesters to request access for others in common business situations:

• New hire onboarding: Prepare access before a new employee’s first day so she or he can start work immediately.

• Team enablement: Empower managers to request access for members of their teams.

• Contractor access: Grant external users narrow, time-bound access to specific resources.

• Incident response: Let team members request access for the right responder without waiting for an Apono admin.

Follow these steps:

1. Click Themselves. An options menu appears.

Option	Description
Themselves	(Default) Allows the requestor to only request resource access for himself or herself
Direct Reports	Allows the requestor, identified as a manager in the organization’s identity provider (IdP), to request resource access solely for individuals formally assigned as direct reports in the IdP
Others (specify)	Allows the requestor to only request resource access on behalf of others (grantees)

1. Click outside of the options menu to close it.

2. (Others (specify)) Define those for whom the requestor can request access:

   1. Click Select attribute to select an attribute, such as User or Group.

   2. (Optional) Click is to select comparative logic from the menu options.

   3. Click Select value to select one or more users or groups from the menu options.

   4. Click outside of the value menu to close it.

   5. (Optional) To add another attribute, click + under the last listed attribute. In the new row that appears, repeat steps 4a-d.

   6. Select the conditional logic for the multiple attributes.

---

Define the resource

Defining resources

Follow these steps:

1. Define access to specific resources.

Resources

Follow these steps to define access to specific resources:

1. Under Request access to, click Resources. The filters options appear.

2. Click Basic.

3. Filter the resources by one or more of the following filters. Resources matching the selected filters display.

To create complex queries, click AQL to build a query in the code box.

The Apono Query Language enables you to extend your query capabilities beyond the standard options available with the UI.

Integration

Follow these steps to filter by integration:

1. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

2. (Optional) In the Search field, enter a value to filter the list of integrations.

3. Select one or more integrations. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Resource Type

Follow these steps to filter by resource type:

1. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

2. (Optional) In the Search field, enter a value to filter the list of resource types.

3. Select one or more resource types. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Resource Name

Follow these steps to filter by resource name:

1. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

2. (Optional) In the Search field, enter a value to filter the list of resource names.

3. (Equals, Not Equals only) Select one or more resource names. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Permission Name

Follow these steps to filter by permission name:

1. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

2. (Optional) In the Search field, enter a value to filter the list of resource names

3. (Equals, Not Equals only) Select one or more permission names. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Resource Path

Follow these steps to filter by resource path:

1. Click (More filters icon) > Resource Path.

2. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

3. (Optional) In the Search field, enter a value to filter the list of resource paths.

4. Select one or more resource paths. Only the values meeting the criteria will be shown.

5. Click outside of the menu to close it.

Resource Source ID

Follow these steps to filter by resource source ID (for example, account, folder, project, Azure subscription, or management group IDs):

1. Click (More filters icon) > Resource Source ID.

2. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • In (in)

   • Not (not in)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

3. (Optional) In the Search field, enter a value to filter the list of IDs.

4. Select one or more IDs. Only the values meeting the criteria will be shown.

5. Click outside of the menu to close it.

Resource Tag

Follow these steps to filter by resource tag:

1. Click (More filters icon) > Resource Tag.

2. (Optional) In the Search field, enter a value to filter the list of resource names.

3. Click the resource name.

4. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

   • Contains (a*b)

   • Does not contain (!a*b)

   • Starts with (*b)

   • Ends with (a*)

5. (Optional) In the Search field, enter a value to filter the list of resource tags.

6. (Equals, Not Equals only) Select one or more resource tags. Only the values meeting the criteria will be shown.

7. Click outside of the menu to close it.

Resource Risk Level

Follow these steps to filter by resource risk level:

1. Click (More filters icon) > Resource Risk Level.

2. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

3. Select one or more resource risk levels. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

Permission Risk Level

Follow these steps to filter by permission risk level:

1. Click (More filters icon) > Permission Risk Level.

2. From the dropdown menu, select the comparative logic:

   • Equals (=)

   • Not Equals (!=)

3. Select one or more pemission risk level. Only the values meeting the criteria will be shown.

4. Click outside of the menu to close it.

1. Click Select Resources or Create Bundle to create a bundle within the flow from the filtered resources.

Bundles

To ensure you do not exceed the AWS inline policy character limit, read AWS Limitations when adding bundles with AWS resources.

Follow these steps to define access to a specific bundle:

1. Under Request access to, click Bundles. The list of bundles appears.

2. (Optional) In the search field, enter a partial or full bundle name to filter the list of bundles.

3. In the Bundle panel, select a bundle. The contents of the bundle logic appears in the AQL pane.

4. Click Use Bundle.

Access Scope

Follow these steps to define access to a specific access scope:

1. Under Request access to, click More Options > Access Scope. The Select access scope menu appears.

2. (Optional) Enter keywords into the search bar to locate an access scope.

3. (Optional) Click (eye icon). A Preview Access Scope pop-up window appears displaying the contents of the access scope.

4. Select an access scope.

You can also click + Create New Access Scope if none of the existing access scopes meet your needs. The Inventory page appears. You can create and use the new access scope.

Integrations

Follow these steps to define access to specific resources:

1. Under Request access to, click More Options > Integrations. The Select integration menu appears.

2. (Optional) Enter keywords into the search bar to locate an integration.

3. Select an integration. The Select resource type panel appears.

4. Select the resource type.

5. Click Done. The panel closes.

6. Click permissions. The Permissions menu appears.

7. Select one or more permissions to grant the requester.

8. Click outside the window to close it.

9. (Optional) Refine the available resources:

   1. Click in the populated to field. A list of resources appears.

   2. Select one or several resources.

By default, the user has access to Any resources. However, the following options allow you to define access more granularly:

• Any resources except specific

• Select by name

• Select by tags

1. (Optional) Click + Select Resources and repeat step 1 to include another resource.

---

Set access duration and approval process

Learn about access duration and best practices.

Access duration and approval process

Follow these steps:

1. Click in the populated Grant for field. The granting period and extend duration options appear.

2. Set the granting period.

Custom

(Default) Grants the requester access for a custom period

The default granting period is set to 1 hour.

Follow these steps to grant access for a custom period:

1. Select the first radio button.

2. From the right dropdown menu, select a time unit.

3. In the first field, enter a numerical value for the time unit.

4. In the second field, select a time unit from the dropdown menu.

Indefinite

Grants the requester access indefinitely

Follow this step to set this period:

1. Click Indefinite.

1. Enable and define extended access duration.

Allow Extend Duration

Allows requestors to extend active access for a limited duration without submitting a new request

Follow these steps:

1. Click the toggle on. When enabled, the toggle turns green.

2. Click in the Allow extending request up to field to choose the number of times the request can be extended, up to a maximum of 10.

3. Click in the Extend for fields to select the duration of each extension, up to the maximum access duration set for the access flow. The default duration is 30 minutes per extension.

Credential rotation, user cleanup, MFA, and approval requirements apply only to new access requests. Extending access preserves the existing session, user, and credentials.

1. Click Automatic to select the approval type.

Automatic

Automatically grants the requester access for the specified period

Automatic approval is the default setting.

Approval of

Grants the requester access for the specified period upon the approval of certain parties

This approval type is ideal for production environments and highly sensitive resources.

Follow these steps to set up Approval of:

1. Click the populated with field. The approval type menu appears.

2. Click Approval of. The Approval of fields appear.

3. Click Select attribute to select an IdP attribute.

If you have connected an incident response integration with Apono, the attribute can also be an on-call shift.

1. (Optional) Click is to select comparative logic from the menu options.

2. Click Select value to select one or more users or groups from the menu options.

3. Click outside of the value menu to close it.

4. (Optional) To add another attribute to the current approver, click + under the last listed attribute. In the new row that appears, repeat steps 3-6.

5. Select the conditional logic for the multiple attributes.

6. (Optional) To add another approver, click + under the last approver. In the new approver that appears, repeat steps 3-8.

7. Select the conditional logic for the multiple groups of approvers.

Condition	Description
ANY OF	If you have multiple approval groups, ANY OF only requires one approver belonging to any group to approve access.
ALL OF	If you have multiple approval groups, ALL OF requires one approver per group to approve access.

1. (Optional) Set the approval escalation.

Set approval escalation

Learn about approval escalation.

Approval escalation settings

Follow these steps to enable approval escalation:

1. Click + Add Escalation Policy. The setting appears.

For this option to appear, custom approval (Approval of) must be configured for the access flow.

1. For the Escalate every rule, set the duration that must elapse before escalating to the next tier:

   1. From the Escalate every dropdown menu (the second field), select a time unit.

   2. In the first field, enter a numerical value for the time unit.

2. Under Escalation Tier #1, click Select attribute to select an IdP attribute, such as User, Group, or Owner.

3. (Optional) Click is to select comparative logic from the menu options.

4. Click Select value to select one or multiple users or groups from the menu options.

5. Click outside of the value menu to close it.

6. (Optional) To add another attribute, click + under the last listed attribute. In the new row that appears, repeat steps 3-6.

7. Select the conditional logic for the multiple attributes.

8. (Optional) To add another escalation tier, repeat steps 3-8.

---

Logic reference

Comparative Logic

The following tables explain the filter comparative logic.

Requestors and grantees

Logic	Description
Is	Checks if values are the same Examples: User is [e-mail] Group is Admin_Group
Is not	Checks if values are different Examples: User is not [e-mail] Group is not Admin_Group
Does not contain	Checks if a value does NOT contain another value as a substring or pattern Examples: User does not contain [e-mail] Group does not contain Admin_Group
Starts with	Checks if a value begins with a specific value or pattern Examples: User starts with ja Group starts with ad

Resources

Logic	Description
Equals (=)	Checks if values are the same Examples: Resource Type equals DynamoDB Table Resource Status equals ACTIVE After filtering by this value, you can select the exact resources to include in your filtered query.
Not Equals (!=)	Checks if values are different Examples: Integration does not equal AWS Playground Resource Type does not equal S3 Bucket After filtering by this value, you can select the exact resources to include in your filtered query.
Contains (a*b)	Checks if a value contains another value as a substring or pattern Examples: Resource Name contains playground Resource Tag contains true
Does not contain (!a*b)	Checks if a value does NOT contain another value as a substring or pattern Examples: Resource Name does not contain production Permission Name does not contain admin
Starts with (*b)	Checks if a value begins with a specific value or pattern Examples: Resource Name starts with aws Resource Tag for a region starts with eu
Ends with (a*)	Checks if a value ends with a specific value or pattern Examples: Resource Name ends with terraform-state Resource Tag for an env ends with dev

Conditional logic

Condition	Description
AND	(Default) Allows the user to request access if they meet all the selected attributes
OR	Allows the user to request access if they meet any of the selected attributes

---

Enable IGA settings

Apono allows administrators to apply various settings to enhance the security of access flows.

All admin settings are optional.

Access flow settings

Setting	Description
Access flow labels	Identifies an access flow for streamlined organization and use When assigned to an access flow, labels appear in the access flow tiles on the Access Flows page. Follow these steps: Enter a value. Press Enter on your keyboard or select an existing label from the filtered list.
Restrict to agentic access	Limits the access flow to agentic requests When enabled, only AI agents acting on behalf of users can request access through the flow. Follow this step: Click the toggle. When enabled, the toggle turns green.
Require MFA	Requires grantees to complete multi-factor authentication to complete a request We strongly recommend enabling MFA for access requests to sensitive resources. The grantee will need to enable multi-factor authentication. Follow this step: Click the toggle. When enabled, the toggle turns green.
Require justification	Requires grantees to enter a justification for their request Follow this step: Click the toggle. When enabled, the toggle turns green.
Require Approver Reason	Requires approvers to provide a reason (limited to 124 characters) when approving or rejecting a request If disabled, providing a reason is optional. Follow this step: Click the toggle. When enabled, the toggle turns green.
Requester and grantee cannot self approve	Prevents users from approving their own access requests If the user is a member of an approval group, they will not receive a notification to approve the request. Follow this step: Click the toggle. When enabled, the toggle turns green.
Description	Access flow summary automatically generated after defining the name, requestors, and resources To keep the description aligned with changes in the access flow, click Generate to refresh it with the latest updates: Click Generate. Apono will populate the field with a new description. (Optional) Review and manually edit the description. (Optional) Provide feedback on the description. Click (thumbs up icon) if the description was helpful. Click (thumbs down icon) and add a comment if the description was unhelpful.