Permanent, always-on permissions to resources (standing access) create security vulnerabilities and complicate access management. Access Discovery helps eliminate unnecessary standing access while ensuring your teams can efficiently request permissions when needed.

Access Discovery analyzes your environment and helps you manage access rights through a two-step process:

• Assessment: Automatically identifies and categorizes standing access to reveal where high-risk permissions exist

• Remediation: Provides instructions to create access flows and revoke unnecessary standing permissions to improve your security posture

For example, you can identify all production resources with standing access, create an access flow for temporary permissions, and safely revoke permanent access. When team members need access, they can request it through the automated workflow, receive temporary permissions, and automatically have access revoked when their temporary permissions have expired.

Prerequisites

Create a new assessment

Follow these steps to assess an integration:

2. Select a Cloud provider.

3. (AWS Organization) Select an integration.

4. Click Assess. The My Assessments page appears with a row for the integration's assessment.

Explore an assessment

Follow these steps to explore an assessment:

1. (Optional) Filter the listed entitlements by one or several of the following filters.

1. Click the row of the entitlement. The Entitlement Details panel opens. The following table explains the content displayed in the Identities section.

1. Click the X in the top right corner of the panel to close the panel.

Remediate access

Follow these steps to remediate an entitlement:

1. On one of the four tier cards, click Remediation Plan. The Remediation Plan popup window appears.

2. In the Step 1 tile, click Create Now. The Create Access Flow page appears with a prepopulated access flow.

1. Under Grant for, you can adjust the access duration and choose a different approver.

2. Click Create Access Flow.

3. Click Back To Assessment. The Remediation Plan popup window reappears with a checkmark indicator in the Step 1 tile.

4. In the Step 2 tile, click Revoke Access. The Revoke standing access page appears.

5. (Optional) Filter the entitlement list by one or several of the following filters.

1. Select one or several entitlements.

2. Click Revoke. The Revoke standing access popup window appears.

3. Follow the instructions to revoke standing access for the selected entitlements with AWS CLI.

4. On the Revoke standing access popup window, click Reassess. The View assessment page for the integration will appear and display your improved access posture score.

1. If other tiers need to be remediated, repeat steps 2-12.

Getting started

You will complete 3 steps to see how easy it is for Admins to manage access with dynamic Access Flows, and how intuitive it is for developers and other end users to request and use Apono access just-in-time.

Try Apono in AWS, then unlock all of your cloud providers and applications for centralized, streamlined access management.

Step 1

Install the connector

If you're just getting started with Apono, we recommend using a local connector deployed with docker image.

How to deploy the local connector

Prerequisites

• A configured AWS profile in your AWS CLI with these permissions: List and IAM to the AWS account and resources you want to integrate.

Steps

2. In the catalog, pick AWS.

3. Pick Account

4. Install a new connector and pick "Local Installation"

For Linux/mac:

1. Copy the command that appears in the Apono App and run it in your terminal: bash <(curl -s https://apono-public.s3.amazonaws.com/local-connector/install.sh) --apono-token <TOKEN> The<TOKEN> will appear in the one-liner the UI generates for you.

2. Follow the interactive prompts and assign:

   1. AWS profile: Apono will leverage the permissions of the profile you pick. If you don't specify the profile, press enter and Apono will use the default profile.

3. Results:

   1. If installed successfully, you will see this message: Installation complete. You can return to the Apono App

4. Go back to the Apono App and continue to integrate AWS. The local connector should appear on the screen with a green checkmark:

For Windows

1. Copy the command that appears in the Apono App and run it in your terminal: iex ([System.Text.Encoding]::UTF8.GetString((Invoke-WebRequest -Uri "https://apono-public.s3.amazonaws.com/local-connector/install.ps1" -UseBasicParsing).Content))

2. Follow the interactive prompts and assign:

   1. The <APONO TOKEN> that appears in the Apono App under the one-liner command.

3. Results:

   1. If installed successfully, you will see the container ID that started running.

4. Go back to the Apono App and continue to integrate AWS. The local connector should appear on the screen with a green checkmark:

Integrate AWS with Apono

1. Provide the AWS config:

   1. An integration name of your choosing

   2. The region of the account you'd like to integrate

2. Click Connect

3. Wait for the integration to sync. This may take a few minutes.

4. Results:

   1. You should see a success message indicating that Apono has successfully integrated with AWS Test.

Step 2

Create an Access Flow

1. Fill in the Access Flow form:

   1. Click Someone to pick who can request the access. You can pick yourself under Users.

   2. Click Select Target to pick the AWS Account you just connected and **the cloud service **you'd like to manage access to. Duplicate this line to include more cloud services in the Access Flow.

   3. Click Any to pick the specific resources in the Access Flow by name, by AWS tags, or by excluding specific resources. You can also leave it as Any.

   4. Click Permissions to pick the permissions users will be able to request.

   5. You can leave the access time as 1 Hour and the approval as Automatic or change them as you'd like.

1. Click Create Access Flow.

2. In the next screen, click Request Access continue to Step 3.

Step 3

Request access

Developers and other end users in the organizations will request access according to the Access Flows using Slack, Teams, CLI, or the Apono Web Portal.

1. Fill in the request form:

   1. Pick the integration

   2. Pick the resource type

   3. Pick resources

   4. Pick permissions

   5. Insert a justification

1. Click Request

Gain and use access

1. The request will appear on the screen with the status Pending

1. Once the connector provisions the access successfully, the status of the request will change to Granted

1. Click View access details

2. The access details can be used to gain the access you just requested! Test it in AWS!

3. Click Finish onboarding.

How Apono Works

Your Questions

1. How does Apono securely integrate with your environment?

2. How are Access Flows defined and managed?

3. How do developers request and approve access?

4. How do admins manage access logs and audit reports?

Great questions, let's get to it:

Integrate with Apono in 3 easy steps

Three easy steps are what it takes to create Just-In-Time and Just Enough permissions for everyone with access to your cloud assets and resources.

1. Install a Connector

Connectors are the components that mediate between Apono and your resources to sync data from cloud applications and grant and revoke access permissions.

The Connector does not read, cache or store any secrets, nor does Apono need an account with admin privileges to function. The Connector contacts your secret store or key vault when it needs to sync data or provision access.

Here's how Connectors work:

2. Integrate With Cloud Apps

After you've installed the Connector, integrate Apono with your cloud applications to sync data on users, groups, resources and permissions.

3. Create Access Flows

Create an Access Flows by answering five questions:

• Who should get access?

• What can they gain access to?

• What Actions will they be able to perform?

• How Long should they have the access?

• Who must Approve the request?

Fill in the blanks using information from drop-down lists, click Create, and you're done.

Apono is Self-Serve

• Using Terraform? Edit your Terraform .tf file to add Apono access management to your resources

Add Apono to Your IaC Configurations

Open-source Terraform or AWS ecosystem, Apono is a recognized provider for both.

Apono's Terraform provider is great for creating and managing integrations, as well as Access Flows!

Just Add Slack or Teams

Apono is built with DevX in mind. With Apono, developers can:

• Gain automatic access without waiting for approval if the Access Flow allows it

• Get access details directly in Slack, Teams or CLI and use them with ease

No more complex forms, old service systems, proxies and clients to install, or hackling your IT department when you need to get work done.

That's why thousands of engineers use Apono for access requests every month!

Audit and Report on Access

Apono automates access logs and audit reports:

Overview

Apono was built and designed with security in mind so that any company is able to use it in their environment.

We applied the same least privilege principles to our product that Apono unlocks for its users:

• Ensure users receive just the right amount of permissions they need

• Ensure users receive access only for the limited time they need them

Security

Apono's secure architecture

The Apono platform is built by two separate components:

• The Web App

• The Connector

The web app continuously receives basic data about users, resources and permissions from the connector.

The connector is fully deployed within the organization’s environment and has a limited set of template functions that can be invoked and are fully in the organization control.

This architecture ensures high reliability as well as segregation of environments, keeping any access to the environment within the environment.

The Web App security

Our web app is a portal for admins to create and manage integrations and Access Flows.

The portal:

• Could only be accessed by admins of the system who've authenticated using the organizational identity provider.

• Doesn't require access to the organization's environment resources. No roles, permissions, privileges, or actions are granted to the app.

• Integrates with the organizational identity provider as the source of truth for the organizational identities.

• Doesn't access your data or environment, and only communicates with the Apono connector.

The Connector security

Our connector is a component you install in your cloud environment (AWS, GCP, Azure, Kubernetes). It communicates with your cloud services and cloud apps using, but not caching or storing, your secrets.

The connector:

• Is completely within the organization's control, as it is installed in your cloud provider.

• Can be uninstalled or disconnected at any time without support from Apono.

• Uses fully visible template functions, mutable by the organization’s environment owner. These functions limit the ability of the connector to only invoke specific actions that are predefined.

• Has no permissions to access the data itself.

• Does not store any secrets.

👍 The Apono Connector is High Availability

No downtime, no outages, no problem!

Your data

When you integrate your cloud applications and IdP with Apono, Apono syncs metadata and configuration information continuously. We only sync basic information needed for access management: users, groups, resources and permissions.

Apono:

• Does not read your data, like datasets, files, documents, code, etc.

• Does not collect any personal data about your employees, Apono only requires a user's email address.

• Does not store or cache secrets or credentials.

Secrets

Apono does not store or cache any of your secrets.

When a data sync is required, the connector gets the secret from your cloud's Secret Store to access the data it needs. After authenticating, the secret is not saved anywhere.

👍 Credentials rotation as often as you need

Architecture

Apono and AWS

Apono and GCP

Apono and Azure

Apono lets you automate static access policies by turning them into declarative, dynamic Access Flows. Integrate your cloud environment, CI/CD stack, cloud infrastructure and databases with Apono. Create Access Flows with our declarative UI or in Terraform, and your developers can use Slack, Teams or CLI to request and approve access.

Protect what matters without breaking a sweat.

Who is Accessing Cloud Resources Right Now?

Do developers have admin/write access or read-only access to production?

Can you answer that, or must you sort through your cloud resources to find out? Of course, by the time you get to the last one, you'll have to recheck the first because so much time has elapsed, and access changes constantly. While discussing it, how long would it take to revoke access to a production cloud resource in an emergency?

With Apono, you have a single point of control for managing access without creating a single point of failure.

Apono Access: Automated, Just-in-Time, Just-Enough

Use Apono for on-demand access to critical resources. Grant an engineer permission to fix a production issue in an emergency. Grant a data scientist access to a data lake when needed. Just as important is to revoke access once it's no longer needed.

Apono's permissions are just-in-time and also ephemeral. Access is automatically revoked when no longer needed. No more forgotten privileges or group memberships left open. Access begins and ends according to Access Flow definition.

Access Management that Scales

No need to manually change permissions for each resource on your cloud platform every time someone needs access to one of its resources. While access can be granted at a granular level, large-scale environments can be managed efficiently by creating Access Flows, for individuals and groups, to all cloud resources and assets.

Apono Integrates with Terraform

Are you using Terraform to manage your cloud platforms?

Apono lets you turn static access policies into dynamic Access Flows directly from Terraform. Reuse a simple build file to build the perfect workflows for your organization without ever leaving Terraform.

Designed for DevX

With Apono, you will work smarter with less effort to manage and gain access to your cloud resources. You will take control of your cloud resource inventory from one central location.

Apono's Access Flows prepare for contingencies, emergency access and regular maintenance. Onboarding becomes quick and easy, with our dynamic Access Flows and access bundles. There's no need for writing and maintaining home-grown scripts and complex workflows.

Your developers can request access bundles and get just the access they need exactly when they need it, no hassle.

Deployed Via Slack and Teams

Developers and engineers love ChatOps and CLI, so why should they have to use another interface?

Apono integrates with Slack, Teams and CLI, so your R&D can use the tools they know to request & approve access, connect to the resources, and, after the access is automatically revoked, request the access again when they need it.

Speaks Your (Declarative) Language

Apono has developed a declarative, natural language format for defining access permissions. No need to edit config files. We call it Access Flow, and it looks like this:

Select a resource and then add (a) who is allowed to gain access (b) what kind of access (roles or permissions) to grant, (c) which specific resources in the integration to allow access to, (d) how long the access should last, (e) should access be approved automatically or by someone in the organization.

In fact, integrating with Apono and creating Access Flows has proven so intuitive that most Apono customers set up and deploy access control for their entire organizations within two weeks.

Keeps Your CISO Happy

Apono doesn't have access to any of your data. Ever.

A Home Run With SOX IT Controls

Apono's comprehensive access management covers your entire cloud, with Access Flows defined for every cloud service and resource type. Need to maintain least-privileges to production environments, financial data, PII, and other critical assets? Check!

Intro

If you want the flexibility of installing the Apono connector on any machine, a docker container is a great alternative.

Step-by-step guide

Prerequisites

1. A docker installed on any machine

2. An Apono token

   • Find Your Integration Token:

     2. Under the Connector section, select Add a New Connector from the drop-down list

     3. Copy the token displayed toward the bottom of the section. This token is unique per account.

Guide

1. In the following command, replace the variables:

   1. Replace APONO-TOKEN with the token you copied in the Prerequisites

   2. For CONNECTOR_ID, insert any name of your choosing

2. Run the command in the terminal:

export APONO_TOKEN=[the token you copied from Apono Add Connector flow]
export CONNECTOR_ID=apono-connector

docker login registry.apono.io -u apono -p $APONO_TOKEN

docker run -e APONO_CONNECTOR_ID=$CONNECTOR_ID -e APONO_TOKEN=$APONO_TOKEN -e APONO_URL=api.apono.io registry.apono.io/apono-connector:v1.6.7

1. That's it!

Results

Many integrations require granting Apono connector credentials to allow it to authenticate and connect. You can create secrets in different secrets managers (e.g. AWS, GCP, Azure) and specify them in the integration secret store. This allows the connector to safely and securely retrieve its credentials in order to connect to the desired integration resources.

Apono supports the following secret managers:

After creating an integration, you can use the Apono UI to find, edit, delete, and perform additional actions on that integration.

Find an integration

You can search for an integration to view its related information.

Follow these steps to locate an integration in the Apono UI:

After searching and applying filters, only integrations matching criteria appear on the Connected tab.

Apply filters

Follow these steps to apply filters:

1. Click the Filters dropdown menu. The filter options appear.

2. From the Where dropdown menu, select an option.

3. From the is dropdown menu, select a value.

4. (Optional) Click + Add new filter and repeat steps 2-3 to add more filters.

5. Click Apply.

Edit an integration

Follow these steps to edit an integration:

2. In the row of the integration, click ⠇> Edit. The Edit Integration page for the integration appears.

3. Update the integration information.

4. Click Update.

The integration will re-sync. If the updates are valid, you will get a success message and see synced resources. Otherwise, error messages will be displayed.

Delete an integration

Follow these steps to delete an integration:

2. In the row of the integration, click ⠇> Delete. A confirmation popup window appears.

1. Click Yes.

Additional integration actions

In addition to finding, editing, or deleting integrations, you can perform other tasks to manage integrations from the Apono UI.

View associated integration resources

Follow these steps to view the associated integration resources:

2. In the row of the integration, click ⠇> Resources. A page of the integration's resources appears.

Refresh an integration

Follow these steps to refresh an integration:

2. In the row of the integration, click ⠇> Refresh. Apono syncs the integration.

\

Find a connector

You can search for a connector to view its related information.

Follow this step to locate a connector in the Apono UI:

Rename a connector

Follow these steps to rename a connector:

2. In the row of the connector, click ⠇**> Edit**. The Edit the Connector page for the connector appears.

3. Update the Connector Name.

4. Click Update Connector.

Delete a connector

Follow these steps to delete a connector:

1. Delete the connector within your cloud environment.

3. In the row of the connector, click ⠇**> Delete**. A confirmation popup window appears.

1. Click Yes.

\

Cloud computing has become an essential tool for businesses of all sizes. As a provider of many services and tools, Amazon Web Services (AWS) is a cloud environment supported by Apono.

The articles in this section will help you connect Apono with your AWS-based resources so that you can effectively manage permissions to these resources.

Overview

To integrate with AWS and start managing JIT access to AWS cloud resources, you must first install a connector in your AWS environment.

The connector should match the level of access management you want to achieve with Apono: on a single account or on the entire organization.

• To manage access to all the accounts in the AWS organization:

How to install the Connector

First, decide if you want to integrate Apono with a specific AWS Account or with the entire Organization (containing multiple Accounts).

Now, follow one of the guides below depending on your selection:

AWS Account Connector

Prerequisites

• Administrator permissions to the AWS account you want to connect.

• VPC with outbound connectivity

1. In Apono

1. Login to the Apono platform

2. Go to the Apono Integrations page

3. From the Catalog, pick AWS

2. In CloudFormation

1. Choose Cloudformation

2. Click "Open Cloud Formation"

3. Sign in to your AWS user and click Next

1. Within the AWS create stack page, scroll down

2. Make sure you pick at least one Subnet and one VPC from the dropdown lists

3. Tick the acknowledge box and then select Create Stack

Apono integrates with AWS natively, using AWS CloudFormation as a standard mechanism to deploy all required configurations including a Cross Account Role with Read permission, a SNS notification message, and the Apono Connector that runs using an AWS ECS on Fargate.

AWS Organization Connector on the management account

Prerequisites

• Administrator permissions to the AWS management account in the Organization.

• VPC with outbound connectivity.

1. In Apono

1. Login to the Apono platform

2. Go to the Apono Integrations page

3. From the Catalog, pick AWS

2. In CloudFormation

1. Click "Open Cloud Formation"

2. Sign in to your AWS user and click Next

1. The new stack should be installed in the management account (which manages the organization's Identity Center)

2. Within the AWS create stack page, scroll down

3. Make sure you pick at least one Subnet and one VPC from the dropdown lists

4. Tick the acknowledge box and then select Create Stack

Apono integrates with AWS natively, using AWS CloudFormation as a standard mechanism to deploy all required configurations including a Cross Account Role with Read permission, a SNS notification message, and the Apono Connector that runs using an AWS ECS on Fargate.

Connector with assumable permissions to the AWS management account

Prerequisites

• Administrator permissions to the AWS management account in the Organization

• For EKS: admin permissions on the cluster

Step 1: Deploy a connector in an AWS account

Using CloudFormation (ECS)

1. Follow the link to open the CloudFormation in the member account you want to deploy.

2. Fill the SubnetIDs, VpcId parameters.

3. Click Create stack, and wait to finish.

4. Copy the connector role from the "Outputs" tab and the connector ID from the "Parameters" tab. These will be required for the next step.

Using Helm (EKS)

2. Set the following environment variables, to set the AWS Role for the connector deployed in EKS.

export AWS_ACCOUNT_ID=  
export AWS_ROLE_NAME=
export CONNECTOR_TOKEN=
export CONNECTOR_ID=

Where:

AWS_ACCOUNT_ID is the account where the EKS deployment is hosted AWS_ROLE_NAME is the role defined for the connector in step 1 CONNECTOR_TOKEN is the token generated in the Apono UI when creating a new connector

CONNECTOR_ID is the connector name. Set any name of your choosing.

1. Run the following helm command to deploy the connector

helm install apono-connector apono-connector --repo https://apono-io.github.io/apono-helm-charts \
    --set-string apono.token=$CONNECTOR_TOKEN \
    --set-string apono.connectorId=$CONNECTOR_ID \
    --set serviceAccount.awsRoleAccountId=$AWS_ACCOUNT_ID \
    --set serviceAccount.awsRoleName=$AWS_ROLE_NAME \
    --set serviceAccount.manageClusterRoles=false \
    --namespace apono-connector \
    --create-namespace

1. Copy the role given to the connector (arn:aws:iam::$AWS_ACCOUNT_ID:role/$AWS_ROLE_NAME)

Step 2: Deploy roles in the Management Account (assumable by the connector)

Purpose: The connector will assume this role in order to manage the entire AWS organization.

2. For the "AponoConnectorId" and "ConnectorRoleArn" parameters, paste the copied values from the previous step.

3. Fill the "OrganizationalUnitId" parameter. You can find it under AWS organizations.

4. Create stack, and wait to finish.

Results

Verify that the Stackset was created successfully and that Cloudformation finished.

Then, In the Apono app, you will see the connector was found and a green checkmark indication.

📘 You have chosen the advanced installation method

How to install the Connector on EKS Using Terraform

Prerequisites

• Required CLI: terraform

Step 1 - Create Connector

Important: before you start, copy the connector Terraform params and export them in the terminal.

Step 2 - Configure Variables

Step 3 - Add necessary Terraform providers

** if you already use your own providers, you can skip this step

Run terraform init to validate it works

Step 4 - Add EKS cluster OIDC provider to your IAM

It's required that your EKS cluster OIDC provider will be added to your IAM. &#xNAN;This step is required only once, and you may have already done it.

Step 5 - Create the Connector IAM role

The Connector is deployed using helm and requires an IAM Role to be able to access tagged ASM secrets in the future.

Step 6 - Deploy Apono Connector

Validate the Connector is Connected

Periodically, you may need to update your AWS connector to help maintain functionality, performance, and security.

This article explains how to update a connector through the AWS CLI and redeploy the CloudFormation stack with the latest connector template.

Prerequisites

Update a connector

Follow these steps to update a connector:

1. Copy the following Account level or Organization level AWS update script. Be sure to replace AWS_STACK_NAME with your AWS stack name.

1. At your AWS CLI prompt, enter the updated script from the previous step to initiate the update. The AWS CLI will return an object containing the StackId.

2. In CloudFormation, on the Stack Info tab, confirm that the update has completed:

   2. Under the Stack name column, click the stack name.

   3. On the Stack info tab, check the Status.

Troubleshooting

This section details common errors that can occur during the updating process. If an error occurs that is not listed below, please contact your Apono representative.

If your organization uses Amazon Web Services (AWS) as a cloud platform, Apono's AWS integrations can help you securely manage access to your AWS cloud-based services and databases.

By identifying and transforming existing privileges, Apono can shift your cloud management from broad permissions to on-demand access flows.

Through our AWS integrations, Apono enables you to perform the following access tasks:

• Limit Access: Discover existing cloud privileges and convert them to just-in-time access flows.

• Enable Self-Service Access: Allow developers to request access to AWS services, buckets, and instances via Slack.

• Automate Approval Workflows: Create automatic approval processes for sensitive AWS resources.

• Restrict Third-Party Access: Grant third-parties (customers or vendors) time-based access to specific S3 buckets, RDS, or EC2 instances with MFA verification.

• Review Access: Audit user cloud access, permissions granted, and reasons for access across AWS.

Apono’s Auto Discovery feature identifies tagged AWS RDS instances, including MySQL and PostgreSQL. Rather than integrating each instance individually, you can integrate selected databases and their resources at once during your AWS Account or Organization setup.

Prerequisites

Enable Auto Discovery

Follow these steps to enable Auto Discovery:

1. In your AWS RDS database instance, create a user for the Apono connector. As part of this step, you will also create a secret.

2. Under Discovery, click Amazon Account or Amazon Organization.

3. Under Connect Sub Integration, select Database, Table, and Role to control the granularity of discovery in each discovered instance. \

After connecting your AWS Account or AWS Organization to Apono, you will be redirected to the Connected tab to view your integrations. The new AWS integration, along with sub-integrations for each RDS instance, initialize during the first data fetch. The integration becomes Active once the process completes.

Troubleshooting

If RDS instances appear with errors on your Integrations page, follow these steps:

1. Check Tags: Verify all required tags are present and correctly formatted.

2. Connector Permissions: Ensure the Apono connector has necessary permissions to read tags and access secrets.

3. Network connectivity: Ensure each RDS instance is accessible by an Apono connector within the same network.

Active-active availability refers to a high availability (HA) architecture, where two or more systems are actively handling requests simultaneously.

HA can provide the following benefits:

• Provide redundancy by maintaining operations during downtime

• Distribute requests across multiple active systems to improve load balancing

• Maximize resource use by employing standby systems

• Reroute traffic through automatic failover to the remaining active system

Apono leverages HA to guarantee uptime to customers. Our on-premise connector can be deployed with several instances. If one instance is down, HA ensures that others are available to continue provisioning.

Prerequisite

Deploy HA connector instances

For HA, you can add instances to an existing connector using the same connector ID.

Follow these steps to add a connector instance for high availability:

2. Select Cloud Installation.

3. Select a platform for the connector. The permission options appear.

4. Select a permissions option.

5. Select an installation method.

Upon completion, you can integrate your HA connectors with your environment.

Connectors are secure on-prem components that link Apono and your resources:

• No secrets are read, cached, or stored.

• No account admin privileges need to be granted to Apono.

• The connector contacts your secret store or key vault to sync data or provision access.

Once set up, this connector will enable you to sync data from cloud applications and grant and revoke access permissions through Amazon Elastic Container Service (ECS).

Prerequisites

Install a connector

Use the following steps to install an Apono connector for AWS on ECS:

1. At the shell prompt, define an environment variable named TF_VAR_APONO_TOKEN with your Apono token value.

1. At the Terraform CLI, download and install the provider plugin and module.

1. Apply the Terraform changes. The proposed changes and a confirmation prompt will be listed.

1. Enter yes to confirm deploying the changes to your AWS account.

FAQ

Apono offers AWS users a simple way to centralize cloud management through our platform. Through a single integration, you can manage multiple AWS services across various accounts and organizations.

Integrate an AWS account

Prerequisites

• To sync and manage access to EC2 servers, make sure you add the AmazonSSMManagedInstanceCore policy to the connector's IAM role

Integration

Follow these steps to integrate Apono with your AWS account:

2. Under Discovery, click Amazon Account.

3. Click one or more resource types to sync with Apono.

1. Click Next. The Apono connector section expands.

2. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.
3. Click Next. The Get more with Apono section expands.

4. Define the Get more with Apono settings.
5. Click Confirm.

After connecting your AWS account to Apono, you will be redirected to the Connected tab to view your integrations. The new AWS integration will initialize once it completes its first data fetch. Upon completion, the integration will be marked Active.

Integrate an AWS organization

Prerequisites

• To sync and manage access to EC2 servers, make sure you add the AmazonSSMManagedInstanceCore policy to the connector's IAM role

Integration

Follow these steps to integrate Apono with your AWS organization:

2. Under Discovery, click Amazon Organization.

3. Click one or more resource types to sync with Apono.

1. Click Next. The Apono connector section expands.

2. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.
3. Click Next. The Get more with Apono section expands.

4. Define the Get more with Apono settings.
5. Click Confirm.

After connecting your AWS account to Apono, you will be redirected to the Connected tab to view your integrations. The new AWS integration will initialize once it completes its first data fetch. Upon completion, the integration will be marked Active.

Troubleshooting

Integrating with Apono

Intro

In order to manage just-in-time access, Apono needs to integrate with your cloud applications. Our integration:

1. Syncs data on users, resources and permissions

2. Automates granting and revoking of users' access to cloud resources

Each integration requires:

1. An installed connector in your cloud environment

2. A specific configuration, which may include:

   1. A role created for Apono

How it works

1. Install a connector

   1. A connector can be installed on AWS (using Cloudformation [ECS], Terraform [EKS], CLI [EKS]) , GCP (using CLI [GKE]), Azure (using Terraform or CLI) or Kubernetes (using Terraform or Helm).
2. Follow the integration guide Per each integration's requirements, supply Apono with:

   1. The role or permission needed to manage access

   2. The metadata to complete the integration NOTE: During this process, you may be required to leave Apono and complete some steps in the source application portal

3. Give the integration a name

   1. The integration name is used when creating Access Flows

   2. This name will be displayed to end-users when creating access requests

4. Wait for the first sync to complete

This is what a healthy AWS Account integration process looks like when using an existing connector:

Integration types

Apono currently supports 3 types of integrations:

1. Resources - these integrations sync data on resources and permissions. Apono then manages JIT access to these resources by granting and revoking users' access based on the Access Flows.

   1. Cloud infrastructure

   2. Databases

   3. CI/CD and development tools

   4. Network and VPN

   5. IdP groups

2. User information - these integrations sync data on your users and their attributes, like manager, shift, groups, etc.

   1. Identity providers (IdP)

   2. Incident response/on-call tools

   3. IT service management (ITSM) tools

3. Communications (chat-ops)

Integrating cloud environments

Overview

Whether you manage your cloud environment in AWS, GCP or Azure, Apono lets you integrate all your cloud services at once!

This means you can manage your entire environment with Apono in a single integration: Apono integrates multiple cloud services from the same AWS Account, GCP Project or Azure Subscription.

In AWS, simply install the connector and secret on any Account you'd like to manage, provide the region and we will do the rest: we'll sync all your resource types, like EC2, RDS, S3 buckets, IAM roles&policies, ECR, EKS, and more all at once.

In GCP, simply install the connector and secret on any Project you'd like to manage and we will do the rest: we'll sync all your resource types, like BigQuery tables, Spanner, Storage, and more all at once.

In Azure, simply install the connector and secret on any Subscription you'd like to manage, and we will do the rest: we'll sync all your resource types, like Storage, MySQL, PostgreSQL, and more all at once.

How it works

1. Go to the Apono Integrations page and click the Catalog tab.

2. Pick your cloud provider: AWS, GCP or Azure

3. Pick the level you'd like to integrate on:

   1. AWS:

      1. Pick Organization to manage access to the SSO Identity Center

      2. Pick Account to sync and manage access to a specific Account and multiple services it contains

   2. GCP

      1. Pick Organization to manage access to the Organization or Folder roles.

      2. Pick Project to sync and manage access to a specific Project and multiple services it contains

   3. Azure

      1. Pick Subscription to sync and manage access to a specific Resource Group and multiple services it contains

4. Provide Apono with the required configuration, and you're done! We'll sync all the services for you.

5. You'll be redirected to the Connected tab, where you can see your integrations and all the services or resource types that were synced for it. This is also the place to see and troubleshoot integration errors and create new Access Flows.