How to: Use Access Bundles
Creating and requesting access bundles with Apono for quick and easy access management
How to: Use Access Bundles
Overview
How do you manage access to different roles or permission sets from different systems centrally? Is there an easy way to control roles, permission sets, permissions, actions and groups that represent a business use case or task in a single place?
Yes there is, and it's called Apono Bundles!
If some users, groups or shifts require a set of permissions to perform tasks, resolve incidents or do their day-to-day work, they can now request an entire bundle instead of refilling the same form and picking multiple access!
The Apono admin can set up the bundle once in the Admin portal, use it in Access Flows - and voila! Users who are included in these Access Flows can request an entire bundle, or just the parts of the bundle they need.
This can save users a lot of time and energy filling access request forms, especially for recurring access needs (for example, if developers request the same set of permissions to the same set of resources every morning).
Use cases
Think of Bundles as Apono's native IAM Role for all your apps: For example, you'd like to manage access to the same set of permissions to resources but create different access duration and approval flow for different users.
Let's say you want to automate access management to Production resources: Read and Write access to S3 buckets in AWS prod, a K8 production namespace, and a specific AWS IAM role. However, you want your PagerDuty On Call developers to get access automatically upon request for 1 hour and other developers to gain permission for 5 hours with their manager's approval.
You can do that with Bundles: Select your scope of resources and the permissions to them you're interested in and reuse them across Access Flows, only changing the grantees, approvers, and access time.
Do you Want to change your bundle, like adding or removing resources and permissions? Edit your Bundle once, and the change will affect all the Access Flows that contain it.
Mix and match bundles and regular permissions to resources in the same Access Flow.
How to create bundles
Go to Access Flows
Click the Bundles tab
See all of your existing Bundles - you can edit and delete them
Click Create Bundle; pick Integrations, Resources, and Permissions. Add as many as you want and Save
Go to Access Flows, create a new Access Flow, or edit an existing one: in the resources section, you can switch between Integrations and Bundles by clicking the tab on the top right corner.
Feel free to add other bundles and permissions to resources, set your grantee, access time, approver time, and Save/Update.
How to request bundles
For requesters
Submitting an access request
Use the Apono Slack app or /apono command to create a new access request
Click the Bundle Mode button on the top right corner
Pick a bundle from the dropdown menu
Users can only pick bundles accessible to them through an active Access Flow
Pick some or all resources and permissions from the list below
Note: You can pick up to 1,000 objects. If a bundle contains more than 1,000 objects, Select all will not work.
Add a Justification
Submit the request
After submitting an access request
Requesters will receive a single message about each status change
Requesters will receive credentials (access details) for each integration separately
When revoked or expired, access to the entire bundle will be deprovisioned together
For approvers
Approvers will receive one Slack message asking to approve or reject the entire bundle
The message contains:
The requester's email
The bundle name
Integrations
Resources
Permissions
Justification
The reason why you are assigned this request
Approve or Deny
You can only approve or deny the entire bundle.
How to manage and audit bundle access
Activity logs
In the admin portal, navigate to the Activity page
In the Activity page, each bundle will appear as a single line with a single request ID. Click the request row to see a complete breakdown of the resources and permissions in it
Reports
In the admin portal, navigate to the Activity page
Click the Reports tab
When creating a report, each row will represent 1 integration with several resources and permissions separated by commas.
The Bundle Name column represents the name of the bundle. Bundles can be spread into several rows, one row for each integration (see above)
Slack audit channel
If you are using the Apono Slack channel to get updates on access requests statuses, you will receive a single message about each status change
Last updated
