PagerDuty

Configure incident-based access with Apono and PagerDuty

Incident-based access streamlines granting access while maintaining security. With this solution, after an on-call engineer acknowledges a PagerDuty incident, the same engineer can request resource access.

The workflow follows these steps:

1. The on-call engineer acknowledges a PagerDuty incident.

2. The same engineer requests resource access through Apono (web portal, Slack, CLI, or Teams).

3. A custom webhook in the access flow verifies the PagerDuty acknowledgment.

4. Once verified, Apono grants access to the required resources.

5. Access automatically expires after a set time or can be manually revoked.

This solution helps you ensure that only the right people get access when it’s needed and improves response times while maintaining compliance. It includes two key components:

• Webhook that verifies incident acknowledgment

• Access flow that manages resource permissions

---

Prerequisites

Item	Description
Apono Account Permissions	Apono permissions to configure webhooks and access flows: Manage Webhooks: Admin, Power User, or Deployment Manage Access Flows: Admin or Deployment
PagerDuty Integration	Integration between Apono and PagerDuty

---

Configure a webhook

This webhook verifies that the grantee is the on-call engineer who acknowledged the PagerDuty incident.

Add Webhook page

Follow these steps to configure an Apono webhook:

1. On the Webhooks tab, click Add Webhook. The Add Webhook page appears.
2. Click Manual.

3. Enter a unique, alphanumeric, user-friendly Manual Webhook Name for identifying this webhook.

4. Click the Status toggle to Active.

5. From the Type dropdown menu, select Integration Action.

6. From the Integration dropdown menu, select your PagerDuty integration.

7. From the Actions dropdown menu, select list_pagerduty_incidents.

8. In the Body Template field, enter the following JSON payload.

{
  "user_email": "{{data.requester.email}}",
  "status": "acknowledged"
}

1. Add a response validation:

   1. In the Response Validators section, click + Add.

   2. In the Json Path field, enter $.incidents[0].status.

   3. In the Expected Values field, type acknowledged and press Enter.

2. Click Save Webhook.

The new webhook appears in the Webhooks table. Active webhooks are marked with a green dot. Inactive webhooks are marked with a white dot.

---

Create a Self Serve access flow

This access flow controls how on-call engineers request and receive temporary access during a PagerDuty incident. It uses the webhook you created to ensure access is granted only to engineers who have acknowledged the incident.

Create Access Flow page

Follow these steps to create the Apono Self Serve access flow for PagerDuty:

1. On the Access Flows tab, define who can request resources through a Self Serve access flow.

In steps 7-9 of Define permitted requestors, select your PagerDuty group.

1. Define the resource to grant access to.
2. Set the access duration and approval process.

In steps 3-5 of Set up custom approval, select Custom Approval and the PagerDuty webhook you created in Configure a webhook.