# Self Serve Access Flows

Self serve access flows grant access to a resource based on a user request for a defined time period.

This access flow type is best used for sensitive or highly regulated resources, such as access to production. It also suits just-in-time (JIT) or break-glass access cases.

To create a self-serve access flow, you must define the permitted requestors, available resources, and approvers.

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-f8ad9c35824979625e6f79a1a03f426da624d5c2%2Faccess-flow-self-serve.png?alt=media" alt="" width="563"><figcaption><p><em>Create Access Flow page</em></p></figcaption></figure>

***

## Prerequisites

<table><thead><tr><th width="153">Item</th><th>Description</th></tr></thead><tbody><tr><td><strong>Cloud resources</strong></td><td><p>One or more resources in a cloud platform that has been integrated with Apono</p><p>If you have not already, integrate Apono with a cloud platform to control access to its resources:</p><ul><li><a href="../../aws-environment/aws-integrations">AWS integrations</a></li><li><a href="../../azure-environment/azure-integrations">Azure integrations</a></li><li><a href="../../gcp-environment/gcp-integrations">GCP integrations</a></li><li><a href="../../kubernetes-environment/kubernetes-integrations">Kubernetes integrations</a></li></ul></td></tr><tr><td><strong>Apono identities</strong></td><td><p>One or more identity sources in the Apono system<br><br>There are various ways to add identities to Apono:</p><ul><li><a href="../../additional-integrations/identity-providers">Integrate an identity provider</a></li><li><a href="../../../user-administration/create-identities#add-a-user">Invite a user manually</a></li></ul></td></tr></tbody></table>

***

## Define permitted requestors

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-1395cb5abfcd5a6660eb3bdae419d21f75064afd%2Faccess-flow-self-serve-define-permitted%20requestors.png?alt=media" alt="" width="563"><figcaption><p>Defining permitted requestors</p></figcaption></figure>

Follow these steps to define the permitted requestors:

1. On the **Access Flows** page, click **Create Access Flow**. The **Create Access Flow** page appears.

{% hint style="success" %}
If [Space Management](https://docs.apono.io/docs/user-administration/space-management) is enabled, select a space from the space selector at the top of the page to create a space-specific access flow.

If no space is selected, the access flow will be created at the global account level.
{% endhint %}

2. Click **Self Serve**. The **Self Serve** fields appear below.
3. Enter an alphanumeric, user-friendly **Access Flow Name**.
4. Click **When**. A settings window appears to set the access period.
5. Set the access period.

   <table><thead><tr><th width="141">Period</th><th>Description</th></tr></thead><tbody><tr><td><strong>Always</strong></td><td><p>(Default) Applies to the requester conditions at all times<br><br>Follow this step to set this period:</p><ol><li>Select <strong>Always</strong>.</li></ol></td></tr><tr><td><strong>Only on</strong></td><td><p>Applies to the requester conditions during a specific time frame<br><br>Follow these steps to set a specific period:</p><ol><li>In the settings window, select <strong>Only on</strong>.</li><li>Select one or more days of the week.</li><li>In the <strong>From</strong> field, select a start time from the dropdown menu.</li><li>In the <strong>to</strong> field, select an end time from the dropdown menu.</li><li>Select a timezone from the dropdown menu.</li></ol></td></tr></tbody></table>
6. Click **Select attribute** to select an attribute, such as **User** or **Group**.
7. (Optional) Click **is** to select conditional logic from the menu options.

{% hint style="info" %}
Other operators include the following:

* **Is not**
* **Contains**
* **Does not contain**
* **Starts with**
  {% endhint %}

8. Click **Select value** to select one or multiple users or groups from the menu options. This selection determines who is permitted to request access.
9. (Optional) Add another attribute.
   1. Under the last listed attribute, click **+**. A new row appears.
   2. Repeat steps **6-8**.
   3. Select the conditional logic for the multiple attributes.

      <table><thead><tr><th width="127">Condition</th><th>Description</th></tr></thead><tbody><tr><td><strong>AND</strong></td><td>(Default) Allows the user to request access if they meet <strong>all</strong> the selected attributes</td></tr><tr><td><strong>OR</strong></td><td>Allows the user to request access if they meet <strong>any</strong> of the selected attributes</td></tr></tbody></table>

### Requesting Access on Behalf of Others

{% hint style="success" %}
**What is it good for?**

* Onboarding new hires – Set up access before day one so they’re ready to go from the start.
* Incident response – Get help from teammates fast, without involving Apono admins.
* Contractors – Request narrow, temporary access for external contractors.
* Team enablement – Empower managers to request access for their team members.
  {% endhint %}

1. Click **Themselves** to define for whom the requestor can request resource access. An options menu appears.
2. Select one or several options.

<table><thead><tr><th width="206.8125">Option</th><th>Description</th></tr></thead><tbody><tr><td><strong>Themselves</strong></td><td>(Default) Allows the requestor to only request resource access for himself or herself</td></tr><tr><td><strong>Direct Reports</strong></td><td>Allows the requestor, identified as a manager in the organization’s identity provider (IdP), to request resource access solely for individuals formally assigned as direct reports in the IdP</td></tr><tr><td><strong>Others (specify)</strong></td><td>Allows the requestor to only request resource access on behalf of others (grantees)</td></tr></tbody></table>

3. (Others, Both) Define the other users:
   1. Click **Select attribute** to select an attribute, such as **User** or **Group**.
   2. (Optional) Click **is** to select conditional logic from the menu options.
   3. Click **Select value** to select one or multiple users or groups from the menu options. This selection determines for whom access can be requested.
4. (Optional) Add another attribute.
   1. Under the last listed attribute, click **+**. A new row appears.
   2. Repeat steps **3a-c**.
   3. Select the conditional logic for the multiple attributes.

      <table><thead><tr><th width="127">Condition</th><th>Description</th></tr></thead><tbody><tr><td><strong>AND</strong></td><td>(Default) Allows the user to request access if they meet <strong>all</strong> the selected attributes</td></tr><tr><td><strong>OR</strong></td><td>Allows the user to request access if they meet <strong>any</strong> of the selected attributes</td></tr></tbody></table>

***

## Define the resource

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-244fa03bd36e5215aa538128a1d2f32ecc979108%2Faccess-flow-self-serve-define-resource.png?alt=media" alt="" width="563"><figcaption><p>Defining integration, access scope, and bundle resources</p></figcaption></figure>

You can define access to specific resources in an Apono integration, bundle, or access scope.

{% hint style="info" %}
If you are creating an access flow within a space, **only space-specific access scopes or bundles** can be used to define the access flow’s resources.
{% endhint %}

{% tabs %}
{% tab title="Integrations" %}
Follow these steps to define access to specific resources:

1. Under **Request access to**, click **Select target > Integrations**.
2. Select an integration. The **Select resource type** panel appears.
3. Select the resource type.
4. Click **Done**. The panel closes.
5. Click **permissions**. The **Permissions** menu appears.
6. Select one or more permissions to grant the requester.
7. (Optional) Refine the available resources:
   1. Click in the populated **to** field. A list of resources appears.
   2. Select one or several resources.

{% hint style="info" %}
By default, the user has access to **Any resources**. However, the following options allow you to define access more granularly:

* **Any resources except specific**
* **Select by name**
* **Select by tags**
  {% endhint %}

8. (Optional) Add another target:
   1. Click **+** at the end of the row. A new target row appears.
   2. Repeat steps **1-7** or add a [bundle](#bundles) or [access scope](#access-scope).
      {% endtab %}

{% tab title="Bundles" %}
{% hint style="success" %}
To ensure you do not exceed the AWS inline policy character limit, read [AWS Limitations](https://docs.apono.io/docs/aws-environment/aws-integrations/integrate-an-aws-account-or-organization/aws-best-practices) when adding bundles with AWS resources.
{% endhint %}

Follow these steps to define access to a specific bundle:

1. Under **Request access to**, click **Select target > Bundles**.
2. (Optional) Click <img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-60eba8f5783f4e89dff5a3aae22caeaf1bf2191e%2Feye-icon.png?alt=media" alt="" data-size="line"> (eye icon). A **Preview Bundle** pop-up window appears displaying the contents of the bundle.
3. Select a bundle.

{% hint style="success" %}
You can also click **+ Create new bundle** if none of the existing bundles meet your needs. The **Create Bundle** page appears. You can [create](https://docs.apono.io/docs/access-flows/create-bundles) a new bundle.
{% endhint %}

4. (Optional) To add another bundle, click **+**. A new target row appears.
5. Repeat steps **1-2** or add an [integration](#integrations) or [access scope](#access-scope).
   {% endtab %}

{% tab title="Access Scope" %}
Follow these steps to define access to a specific access scope:

1. Under **Request access to**, click **Select target > Access Scope**. The **Select access scope** menu appears.

{% hint style="success" %}
You may enter keywords into the search bar to locate an access scope.
{% endhint %}

2. (Optional) Click <img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXf6tv7vrABRqb_3sHCQCkp-gGx-9GBQoWehtQXr2GjwUAv4jEwSuTan9BsckFs_R3hKm1zWb86-4gCVU2AUtQspUPRizHDEtlXAPc1m_OyItAOugW6buj8hpUTBGTjgccmKsyn-tQ?key=A4EZtKjLdP_MEnXmQA_WQ-Ky" alt="" data-size="line"> (eye icon). A **Preview Access Scope** pop-up window appears displaying the contents of the access scope.
3. Select an access scope.

{% hint style="success" %}
You can also click **+ Create New Access Scope** if none of the existing access scopes meet your needs. The **Inventory** page appears. You can [create](https://docs.apono.io/docs/inventory/access-scopes#create-an-access-scope) and [use](https://docs.apono.io/docs/inventory/access-scopes#use-an-access-scope) the new access scope.
{% endhint %}

4. (Optional) To add another access scope, click **+**. A new target row appears.
5. Repeat steps **1-3** or add an [integration](#integrations) or [bundle](#bundles).
   {% endtab %}
   {% endtabs %}

***

## Set access duration and approval process

{% hint style="success" %}
Learn about [access duration and best practices](https://docs.apono.io/docs/access-flows/creating-access-flows-in-apono/access-duration).
{% endhint %}

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-b3f4fb9aa54d8edaadf4af4439c563105db9747b%2Faccess-flow-self-serve-grant-approval-for.png?alt=media" alt="" width="563"><figcaption><p>Access duration and approval process</p></figcaption></figure>

Follow these steps to define the duration of access:

1. Click in the populated **Grant for** field. The granting period settings appear.

   <table><thead><tr><th width="138">Period</th><th>Description</th></tr></thead><tbody><tr><td><strong>Custom</strong></td><td><p>(Default) Grants the requester access for a custom period<br><br>The default granting period is set to <em>1 hour</em>.<br><br>Follow these steps to grant access for a custom period:</p><ol><li>Select the first radio button.</li><li>From the right dropdown menu, select a time unit.</li><li>In the first field, enter a numerical value for the time unit.</li><li>In the second field, select a time unit from the dropdown menu.</li></ol></td></tr><tr><td><strong>Indefinite</strong></td><td><p>Grants the requester access indefinitely<br><br>Follow this step to set this period:</p><ol><li>Click <strong>Indefinite</strong>.</li></ol></td></tr></tbody></table>
2. Click **Automatic** to select the approval type.

   <table><thead><tr><th width="137.4765625">Period</th><th>Description</th></tr></thead><tbody><tr><td><strong>Automatic</strong></td><td>Automatically grants the requester access for the specified period<br><br><strong>Automatic</strong> approval is the default setting.</td></tr><tr><td><strong>Approval of</strong></td><td>Grants the requester access for the specified period upon the approval of certain parties<br><br>For more information, learn how to <a href="#set-up-custom-approval">set up custom approval</a>.</td></tr></tbody></table>
3. Click **Create Access Flow**.

### Set up custom approval

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-7862aa10dce029ec2c67daa790a9ae030dda8e34%2Fself-serve-af-1.png?alt=media" alt="" width="375"><figcaption><p><em>Custom approval flow</em></p></figcaption></figure>

**Approval of** provides in-depth options to customize the approval flow. This approval type is ideal for production environments and highly sensitive resources.

Follow these steps to set up **Approval of**:

1. Click the populated **with** field. The approval type menu appears.
2. Click **Approval of**. The **Approval of** fields appear.
3. Click **Select attribute** to select an IdP attribute, such as **User**, **Group**, or **Owner**.

{% hint style="info" %}
If you have connected an [incident response integration](https://docs.apono.io/docs/additional-integrations/incident-response-integrations/opsgenie) with Apono, the attribute can also be an on-call shift.
{% endhint %}

4. (Optional) Click **is** to select conditional logic from the menu options.

{% hint style="info" %}
Other operators include the following:

* **Is not**
* **Contains**
* **Does not contain**
* **Starts with**
  {% endhint %}

5. Click **Select value** to select one or multiple users or groups from the menu options. This selection determines who is permitted to approve access.
6. (Optional) Add another approver condition.
   1. Immediately beneath the last list approver, click **+**. A new row appears.
   2. Repeat steps **3-5** to add another approver to the group.
   3. Select the conditional logic for the multiple approvers.

      <table><thead><tr><th width="139">Condition</th><th>Description</th></tr></thead><tbody><tr><td><strong>AND</strong></td><td>(Default) If you have multiple attributes in the approval group, <strong>AND</strong> requires the approver to meet all the attributes.</td></tr><tr><td><strong>OR</strong></td><td>If you have multiple attributes in the approval group, <strong>OR</strong> requires the approver to meet only one of the attributes.</td></tr></tbody></table>
7. (Optional) Add another approver group.
   1. Beneath the last approver group, click **+**. A new approval group appears.
   2. Repeat steps **3-5** to add another approver to the group.
   3. Select the conditional logic for the multiple groups of approvers.

      <table><thead><tr><th width="143">Condition</th><th>Description</th></tr></thead><tbody><tr><td><strong>ANY OF</strong></td><td>If you have multiple approval groups, <strong>ANY OF</strong> only requires one approver belonging to any group to approve access.</td></tr><tr><td><strong>ALL OF</strong></td><td>If you have multiple approval groups, <strong>ALL OF</strong> requires one approver per group to approve access.</td></tr></tbody></table>

***

## Set approval escalation

{% hint style="success" icon="lightbulb" %}
Learn about [approval escalation](https://docs.apono.io/docs/access-flows/creating-access-flows-in-apono/approval-escalation).
{% endhint %}

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-f5f5a6be3509a55930bc603b6d65e447cce440f4%2Fapproval-escalation-access-flow.png?alt=media" alt="" width="563"><figcaption><p>Approval escalation settings</p></figcaption></figure>

Follow these steps to enable approval escalation:

1. Click **+ Add Escalation Policy**. The setting appears.

{% hint style="info" %}
For this option to appear, [custom approval](#set-up-custom-approval) must be configured for the access flow.
{% endhint %}

2. For the **Escalate every** rule, set the duration that must elapse before escalating to the next tier:
   1. From the **Escalate every** dropdown menu (the second field), select a time unit.
   2. In the first field, enter a numerical value for the time unit.
3. Under **Escalation Tier #1**, click **Select attribute** to select an IdP attribute, such as **User**, **Group**, or **Owner**.
4. (Optional) Click **is** to select conditional logic from the menu options.

{% hint style="info" %}
Other operators include the following:

* **Is not**
* **Contains**
* **Does not contain**
* **Starts with**
  {% endhint %}

4. Click **Select value** to select one or multiple users or groups from the menu options. This selection determines who is permitted to approve access.
5. (Optional) Add another approver condition.
   1. Immediately beneath the last list approver, click **+**. A new row appears.
   2. Repeat steps **2-4** to add another approver to the group.
   3. Select the conditional logic for the multiple approvers.

<table><thead><tr><th width="182.4609375">Condition</th><th>Description</th></tr></thead><tbody><tr><td><strong>AND</strong></td><td>(Default) If you have multiple attributes in the approval group, <strong>AND</strong> requires the approver to meet all the attributes.</td></tr><tr><td><strong>OR</strong></td><td>If you have multiple attributes in the approval group, <strong>OR</strong> requires the approver to meet only one of the attributes.</td></tr></tbody></table>

6. Repeat steps **2-5** for each escalation tier.

***

## Enable IGA settings

Apono allows administrators to apply various settings to enhance the security of access flows.

{% hint style="info" %}
All admin settings are optional.
{% endhint %}

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-d39d3adac9b0320e4aa6973b1d2149d67f114d83%2Faccess-flow-self-serve-iga-settings-new.png?alt=media" alt="" width="327"><figcaption><p>Access flow settings</p></figcaption></figure>

<table><thead><tr><th width="204">Setting</th><th>Description</th></tr></thead><tbody><tr><td><strong>Access flow labels</strong></td><td><p>Identifies an access flow for streamlined organization and use</p><p>When assigned to an access flow, labels appear in the access flow tiles on the <a href="https://app.apono.io/access-flows"><strong>Access Flows</strong></a> page.</p><p>Follow these steps:</p><ol><li>Enter a value.</li><li>Press Enter on your keyboard or select an existing label from the filtered list.</li></ol></td></tr><tr><td><strong>Require MFA</strong></td><td><p>Requires grantees to complete multi-factor authentication to complete a request</p><p><br>We <strong>strongly recommend</strong> enabling MFA for access requests to sensitive resources.</p><p>The grantee will need to <a href="../../../architecture-and-security/multi-factor-authentication#enable-mfa-for-a-requester-account">enable multi-factor authentication</a>.<br></p><p>Follow this step:</p><ol><li>Click the toggle. When enabled, the toggle turns green.</li></ol></td></tr><tr><td><strong>Require justification</strong></td><td><p>Requires grantees to enter a justification for their request<br></p><p>Follow this step:</p><ol><li>Click the toggle. When enabled, the toggle turns green.</li></ol></td></tr><tr><td><strong>Require Approver Reason</strong></td><td><p>Requires approvers to provide a reason (limited to 124 characters) when approving or rejecting a request</p><p><br>If disabled, providing a reason is optional.<br></p><p>Follow this step:</p><ol><li>Click the toggle. When enabled, the toggle turns green.</li></ol></td></tr><tr><td><strong>Requester and grantee cannot self approve</strong></td><td><p>Prevents users from approving their own access requests</p><p>If the user is a member of an approval group, they will <strong>not</strong> receive a notification to approve the request.<br></p><p>Follow this step:</p><ol><li>Click the toggle. When enabled, the toggle turns green.</li></ol></td></tr><tr><td><strong>Allow extending request</strong></td><td><p>Allows requestors to extend active access for a limited duration without submitting a new request<br></p><p>Follow these steps:</p><ol><li>Click the toggle. When enabled, the toggle turns green.</li><li>Click in the <strong>Allow extending request up to</strong> field to choose the number of times the request can be extended, up to a maximum of 10.</li><li>Click in the <strong>Extend for</strong> fields to select the duration of each extension, up to the maximum access duration set for the access flow. The default duration is <strong>30 minutes</strong> per extension.</li></ol><p>Credential rotation, user cleanup, MFA, and approval requirements apply only to new access requests. <strong>Extending access preserves the existing session, user, and credentials.</strong></p></td></tr><tr><td><strong>Description</strong></td><td><p>Access flow summary automatically generated after defining the name, requestors, and resources</p><p>To keep the description aligned with changes in the access flow, click <strong>Generate</strong> to refresh it with the latest updates:</p><ol><li>Click <strong>Generate</strong>. Apono will populate the field with a new description.</li><li>(Optional) Review and manually edit the description.</li><li>(Optional) Provide feedback on the description. Click <img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-d868fa52ded73e3907fd4a933a7604a7ca609c7b%2Faccess-clarity-approve.png?alt=media" alt="" data-size="line"> (thumbs up icon) if the description was helpful. Click <img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-ca6382f453f0c527252bc69d4df55144f98992a5%2Faccess-clarity-disapprove.png?alt=media" alt="" data-size="line"> (thumbs down icon) and add a comment if the description was unhelpful.</li></ol></td></tr></tbody></table>