Apono lets you automate static access policies by turning them into declarative, dynamic Access Flows. Integrate your cloud environment, CI/CD stack, cloud infrastructure and databases with Apono. Create Access Flows with our declarative UI or in Terraform, and your developers can use Slack, Teams or CLI to request and approve access.

Protect what matters without breaking a sweat.

Who is Accessing Cloud Resources Right Now?

Do developers have admin/write access or read-only access to production?

Can you answer that, or must you sort through your cloud resources to find out? Of course, by the time you get to the last one, you'll have to recheck the first because so much time has elapsed, and access changes constantly. While discussing it, how long would it take to revoke access to a production cloud resource in an emergency?

With Apono, you have a single point of control for managing access without creating a single point of failure.

Apono Access: Automated, Just-in-Time, Just-Enough

Use Apono for on-demand access to critical resources. Grant an engineer permission to fix a production issue in an emergency. Grant a data scientist access to a data lake when needed. Just as important is to revoke access once it's no longer needed.

Apono's permissions are just-in-time and also ephemeral. Access is automatically revoked when no longer needed. No more forgotten privileges or group memberships left open. Access begins and ends according to Access Flow definition.

Access Management that Scales

No need to manually change permissions for each resource on your cloud platform every time someone needs access to one of its resources. While access can be granted at a granular level, large-scale environments can be managed efficiently by creating Access Flows, for individuals and groups, to all cloud resources and assets.

Your environment is always evolving, and so does Apono. Use hierarchies, tags and exclude for dynamic access management.

Apono Integrates with Terraform

Are you using Terraform to manage your cloud platforms?

That's great because Apono is a Terraform provider and can be provisioned to work alongside your resources by adding code blocks to integrate them into Apono. When you bring up a resource, it will immediately benefit from Apono access management.

Apono lets you turn static access policies into dynamic Access Flows directly from Terraform. Reuse a simple build file to build the perfect workflows for your organization without ever leaving Terraform.

Designed for DevX

With Apono, you will work smarter with less effort to manage and gain access to your cloud resources. You will take control of your cloud resource inventory from one central location.

Apono's Access Flows prepare for contingencies, emergency access and regular maintenance. Onboarding becomes quick and easy, with our dynamic Access Flows and access bundles. There's no need for writing and maintaining home-grown scripts and complex workflows.

Your developers can request access bundles and get just the access they need exactly when they need it, no hassle.

Deployed Via Slack and Teams

Developers and engineers love ChatOps and CLI, so why should they have to use another interface?

Apono integrates with Slack, Teams and CLI, so your R&D can use the tools they know to request & approve access, connect to the resources, and, after the access is automatically revoked, request the access again when they need it.

Speaks Your (Declarative) Language

Apono has developed a declarative, natural language format for defining access permissions. No need to edit config files. We call it Access Flow, and it looks like this:

Select a resource and then add (a) who is allowed to gain access (b) what kind of access (roles or permissions) to grant, (c) which specific resources in the integration to allow access to, (d) how long the access should last, (e) should access be approved automatically or by someone in the organization.

In fact, integrating with Apono and creating Access Flows has proven so intuitive that most Apono customers set up and deploy access control for their entire organizations within two weeks.

Keeps Your CISO Happy

Apono doesn't have access to any of your data. Ever.

How does it work? Install our connector in your environment, direct it to your secret store and you're done! The connector manages the data syncs to our app and handles access provisioning and de-provisioning to your services, without storing or caching secrets.

We call it SasS with on-premise level of security. And you can tell your customers that they can be confident that access to their data is protected.

A Home Run With SOX IT Controls

Apono's comprehensive access management covers your entire cloud, with Access Flows defined for every cloud service and resource type. Need to maintain least-privileges to production environments, financial data, PII, and other critical assets? Check!

Access requests and granted access are all logged, so you have a reliable audit of the access to your data. As part of your IT compliance reporting to SOX, HIPAA, GDPR, PCI DSS, SOC 2 and others, use Apono's audit logs and reports. Send them to external auditors, internal GRC and security teams, and export logs directly to ITSM, SIEM and compliance tools.

How Apono Works

Your Questions

1. How does Apono securely integrate with your environment?

2. How are Access Flows defined and managed?

3. How do developers request and approve access?

4. How do admins manage access logs and audit reports?

Great questions, let's get to it:

Integrate with Apono in 3 easy steps

Three easy steps are what it takes to create Just-In-Time and Just Enough permissions for everyone with access to your cloud assets and resources.

1. Install a Connector

Connectors are the components that mediate between Apono and your resources to sync data from cloud applications and grant and revoke access permissions.

The Connector does not read, cache or store any secrets, nor does Apono need an account with admin privileges to function. The Connector contacts your secret store or key vault when it needs to sync data or provision access.

Here's how Connectors work:

2. Integrate With Cloud Apps

After you've installed the Connector, integrate Apono with your cloud applications to sync data on users, groups, resources and permissions.

Apono currently has integrations for 35+ resource types in AWS, GCP, Azure and Kubernetes platforms, as well as development and CI/CD tools, databases, incident response tools, IdP, ChatOps products, and more. Check the Integrations Catalog for details and to see the latest.

3. Create Access Flows

Create an Access Flows by answering five questions:

• Who should get access?

• What can they gain access to?

• What Actions will they be able to perform?

• How Long should they have the access?

• Who must Approve the request?

Fill in the blanks using information from drop-down lists, click Create, and you're done.

Apono is Self-Serve

Apono is completely self-serve! Curious? Try it for yourself (no demo needed)!

• Using Terraform? Edit your Terraform .tf file to add Apono access management to your resources

Add Apono to Your IaC Configurations

Open-source Terraform or AWS ecosystem, Apono is a recognized provider for both.

Prepare Terraform configuration scripts by referring to the Terraform Installation Guide. You will also need the Integrations Metadata to learn what to included in each Apono resource.

Apono's Terraform provider is great for creating and managing integrations, as well as Access Flows!

Just Add Slack or Teams

Apono is built with DevX in mind. With Apono, developers can:

• Request access directly in their favorite tool: Slack, Teams or CLI

• Gain automatic access without waiting for approval if the Access Flow allows it

• Get access details directly in Slack, Teams or CLI and use them with ease

No more complex forms, old service systems, proxies and clients to install, or hackling your IT department when you need to get work done.

That's why thousands of engineers use Apono for access requests every month!

Audit and Report on Access

Apono automates access logs and audit reports:

• Every access request and action are fully logged

• Query logs to get exactly what you need, even with our Public API!

• Periodic reports and compliance needs? No problem! Create, save, download and schedule reports at will. We'll send it directly to your inbox.

Overview

Apono was built and designed with security in mind so that any company is able to use it in their environment.

We applied the same least privilege principles to our product that Apono unlocks for its users:

• Ensure users receive just the right amount of permissions they need

• Ensure users receive access only for the limited time they need them

Security

Apono's secure architecture

The Apono platform is built by two separate components:

• The Web App

• The Connector

The web app continuously receives basic data about users, resources and permissions from the connector.

The connector is fully deployed within the organization’s environment and has a limited set of template functions that can be invoked and are fully in the organization control.

This architecture ensures high reliability as well as segregation of environments, keeping any access to the environment within the environment.

The Web App security

Our web app is a portal for admins to create and manage integrations and Access Flows.

The portal:

• Could only be accessed by admins of the system who've authenticated using the organizational identity provider.

• Doesn't require access to the organization's environment resources. No roles, permissions, privileges, or actions are granted to the app.

• Integrates with the organizational identity provider as the source of truth for the organizational identities.

• Doesn't access your data or environment, and only communicates with the Apono connector.

The Connector security

Our connector is a component you install in your cloud environment (AWS, GCP, Azure, Kubernetes). It communicates with your cloud services and cloud apps using, but not caching or storing, your secrets.

The connector:

• Is completely within the organization's control, as it is installed in your cloud provider.

• Can be uninstalled or disconnected at any time without support from Apono.

• Uses fully visible template functions, mutable by the organization’s environment owner. These functions limit the ability of the connector to only invoke specific actions that are predefined.

• Has no permissions to access the data itself.

• Does not store any secrets.

👍 The Apono Connector is High Availability

No downtime, no outages, no problem!

Our Round Robin method helps ensure uptime for your Apono integrations as users request access. Several connector instances will continue provisioning and deprovisioning access as needed.

Your data

When you integrate your cloud applications and IdP with Apono, Apono syncs metadata and configuration information continuously. We only sync basic information needed for access management: users, groups, resources and permissions.

Apono:

• Does not read your data, like datasets, files, documents, code, etc.

• Does not collect any personal data about your employees: Apono needs a user's email, and that's it.

• Does not store or cache secrets or credentials

Secrets

Apono does not store or cache any of your secrets.

When a data sync is required, the connector gets the secret from your cloud's Secret Store to access the data it needs. After authenticating, the secret is not saved anywhere.

👍 Credentials rotation as often as you need

When granting access to users, Apono enforces password reset and credentials rotation out of the box to meet the strictest compliance and security standards. Read more here.

Architecture

Apono and AWS

Apono and GCP

Apono and Azure

Getting started

Get a taste of what Apono can do by (it's free!) and then follow our onboarding wizard.

You will complete 3 steps to see how easy it is for Admins to manage access with dynamic Access Flows, and how intuitive it is for developers and other end users to request and use Apono access just-in-time.

Try Apono in AWS, then unlock all of your cloud providers and applications for centralized, streamlined access management.

Step 1

Install the connector

If you're just getting started with Apono, we recommend using a local connector deployed with docker image.

How to deploy the local connector

Prerequisites

• A configured AWS profile in your AWS CLI with these permissions: List and IAM to the AWS account and resources you want to integrate.

Steps

2. In the catalog, pick AWS.

3. Pick Account

4. Install a new connector and pick "Local Installation"

For Linux/mac:

1. Copy the command that appears in the Apono App and run it in your terminal: bash <(curl -s https://apono-public.s3.amazonaws.com/local-connector/install.sh) --apono-token <TOKEN> The<TOKEN> will appear in the one-liner the UI generates for you.

2. Follow the interactive prompts and assign:

   1. AWS profile: Apono will leverage the permissions of the profile you pick. If you don't specify the profile, press enter and Apono will use the default profile.

3. Results:

   1. If installed successfully, you will see this message: Installation complete. You can return to the Apono App

4. Go back to the Apono App and continue to integrate AWS. The local connector should appear on the screen with a green checkmark:

For Windows

1. Copy the command that appears in the Apono App and run it in your terminal: iex ([System.Text.Encoding]::UTF8.GetString((Invoke-WebRequest -Uri "https://apono-public.s3.amazonaws.com/local-connector/install.ps1" -UseBasicParsing).Content))

2. Follow the interactive prompts and assign:

   1. The <APONO TOKEN> that appears in the Apono App under the one-liner command.

3. Results:

   1. If installed successfully, you will see the container ID that started running.

4. Go back to the Apono App and continue to integrate AWS. The local connector should appear on the screen with a green checkmark:

Integrate AWS with Apono

1. Provide the AWS config:

   1. An integration name of your choosing

   2. The region of the account you'd like to integrate

2. Click Connect

3. Wait for the integration to sync. This may take a few minutes.

4. Results:

   1. You should see a success message indicating that Apono has successfully integrated with AWS Test.

Step 2

Create an Access Flow

1. Fill in the Access Flow form:

   1. Click Someone to pick who can request the access. You can pick yourself under Users.

   2. Click Select Target to pick the AWS Account you just connected and **the cloud service **you'd like to manage access to. Duplicate this line to include more cloud services in the Access Flow.

   3. Click Any to pick the specific resources in the Access Flow by name, by AWS tags, or by excluding specific resources. You can also leave it as Any.

   4. Click Permissions to pick the permissions users will be able to request.

   5. You can leave the access time as 1 Hour and the approval as Automatic or change them as you'd like.

1. Click Create Access Flow.

2. In the next screen, click Request Access continue to Step 3.

Step 3

Request access

Developers and other end users in the organizations will request access according to the Access Flows using Slack, Teams, CLI, or the Apono Web Portal.

1. Fill in the request form:

   1. Pick the integration

   2. Pick the resource type

   3. Pick resources

   4. Pick permissions

   5. Insert a justification

1. Click Request

Gain and use access

1. The request will appear on the screen with the status Pending

1. Once the connector provisions the access successfully, the status of the request will change to Granted

1. Click View access details

2. The access details can be used to gain the access you just requested! Test it in AWS!

3. Click Finish onboarding.

Integrating with Apono

Intro

In order to manage just-in-time access, Apono needs to integrate with your cloud applications. Our integration:

1. Syncs data on users, resources and permissions

2. Automates granting and revoking of users' access to cloud resources

Each integration requires:

1. An installed connector in your cloud environment

2. A specific configuration, which may include:

   1. A role created for Apono

   2. Metadata like proxy address, hostname, port, region, clusters, secret store, etc. To learn more about each integration's required config, visit the integration guide or our guides.

How it works

1. Install a connector

   1. A connector can be installed on AWS (using Cloudformation [ECS], Terraform [EKS], CLI [EKS]) , GCP (using CLI [GKE]), Azure (using Terraform or CLI) or Kubernetes (using Terraform or Helm).

   2. Follow NOTE: If you have installed a connector in the past, you may use it for more than 1 integration\

2. Follow the integration guide Per each integration's requirements, supply Apono with:

   1. The role or permission needed to manage access

   2. The metadata to complete the integration NOTE: During this process, you may be required to leave Apono and complete some steps in the source application portal\

3. Give the integration a name

   1. The integration name is used when creating Access Flows

   2. This name will be displayed to end-users when creating access requests

4. Wait for the first sync to complete

   1. Follow the status in the Integrations page Connected tab. A healthy integration looks like this:

   2. In case of error, follow our

5. All set! with your new integration

This is what a healthy AWS Account integration process looks like when using an existing connector:

Integration types

Apono currently supports 3 types of integrations:

1. Resources - these integrations sync data on resources and permissions. Apono then manages JIT access to these resources by granting and revoking users' access based on the Access Flows.

   1. Cloud infrastructure

   2. Databases

   3. CI/CD and development tools

   4. Network and VPN

   5. IdP groups

2. User information - these integrations sync data on your users and their attributes, like manager, shift, groups, etc.

   1. Identity providers (IdP)

   2. Incident response/on-call tools

   3. IT service management (ITSM) tools

3. Communications (chat-ops)

Integrating cloud environments

Overview

Whether you manage your cloud environment in AWS, GCP or Azure, Apono lets you integrate all your cloud services at once!

This means you can manage your entire environment with Apono in a single integration: Apono integrates multiple cloud services from the same AWS Account, GCP Project or Azure Subscription.

In AWS, simply install the connector and secret on any Account you'd like to manage, provide the region and we will do the rest: we'll sync all your resource types, like EC2, RDS, S3 buckets, IAM roles&policies, ECR, EKS, and more all at once.

In GCP, simply install the connector and secret on any Project you'd like to manage and we will do the rest: we'll sync all your resource types, like BigQuery tables, Spanner, Storage, and more all at once.

In Azure, simply install the connector and secret on any Subscription you'd like to manage, and we will do the rest: we'll sync all your resource types, like Storage, MySQL, PostgreSQL, and more all at once.

How it works

1. Go to the Apono Integrations page and click the Catalog tab.

2. Pick your cloud provider: AWS, GCP or Azure

3. Pick the level you'd like to integrate on:

   1. AWS:

      1. Pick Organization to manage access to the SSO Identity Center

      2. Pick Account to sync and manage access to a specific Account and multiple services it contains

   2. GCP

      1. Pick Organization to manage access to the Organization or Folder roles.

      2. Pick Project to sync and manage access to a specific Project and multiple services it contains

   3. Azure

      1. Pick Subscription to sync and manage access to a specific Resource Group and multiple services it contains

4. Provide Apono with the required configuration, and you're done! We'll sync all the services for you.

5. You'll be redirected to the Connected tab, where you can see your integrations and all the services or resource types that were synced for it. This is also the place to see and troubleshoot integration errors and create new Access Flows.

Intro

If you want the flexibility of installing the Apono connector on any machine, a docker container is a great alternative.

Step-by-step guide

Prerequisites

1. A docker installed on any machine

2. An Apono token

   • Find Your Integration Token:

     1. Select any integration in the Catalog.

     2. Under the Connector section, select Add a New Connector from the drop-down list

     3. Copy the token displayed toward the bottom of the section. This token is unique per account.

Guide

1. In the following command, replace the variables:

   1. Replace APONO-TOKEN with the token you copied in the Prerequisites

   2. For CONNECTOR_ID, insert any name of your choosing

2. Run the command in the terminal:

export APONO_TOKEN=[the token you copied from Apono Add Connector flow]
export CONNECTOR_ID=apono-connector

docker login registry.apono.io -u apono -p $APONO_TOKEN

docker run -e APONO_CONNECTOR_ID=$CONNECTOR_ID -e APONO_TOKEN=$APONO_TOKEN -e APONO_URL=api.apono.io registry.apono.io/apono-connector:v1.6.7

1. That's it!

Results

1. If done correctly, you should see your docker Connector in the new integration dropdown list, or in the Connectors page

After creating a connector in your AWS, Azure, GCP, or Kubernetes environment, you can use the Apono UI to find, rename, and delete that connector.

Find a connector

You can search for a connector to view its related information.

Follow this step to locate a connector in the Apono UI:

1. On the Connectors page, in the search bar, enter the name of the connector. All matching connectors appear.

Rename a connector

Follow these steps to rename a connector:

1. On the Connectors page, in the search bar, enter the name of the connector. All matching connectors appear.

2. In the row of the connector, click ⠇**> Edit**. The Edit the Connector page for the connector appears.

3. Update the Connector Name.

4. Click Update Connector.

Delete a connector

Follow these steps to delete a connector:

1. Delete the connector within your cloud environment.

2. On the Connectors page, in the search bar, enter the name of the connector. All matching connectors appear.

3. In the row of the connector, click ⠇**> Delete**. A confirmation popup window appears.

1. Click Yes.

\

After creating an integration, you can use the Apono UI to find, edit, delete, and perform additional actions on that integration.

Find an integration

You can search for an integration to view its related information.

Follow these steps to locate an integration in the Apono UI:

1. On the Connected tab, in the search bar, enter the name of the integration. All matching integrations appear.

2. (Optional) Apply one or more filters.

After searching and applying filters, only integrations matching criteria appear on the Connected tab.

Apply filters

Follow these steps to apply filters:

1. Click the Filters dropdown menu. The filter options appear.

2. From the Where dropdown menu, select an option.

3. From the is dropdown menu, select a value.

4. (Optional) Click + Add new filter and repeat steps 2-3 to add more filters.

5. Click Apply.

Edit an integration

Follow these steps to edit an integration:

1. Find an integration.

2. In the row of the integration, click ⠇**> Edit**. The Edit Integration page for the integration appears.

3. Update the integration information.

4. Click Update.

The integration will re-sync. If the updates are valid, you will get a success message and see synced resources. Otherwise, error messages will be displayed.

Delete an integration

Follow these steps to delete an integration:

1. Find an integration.

2. In the row of the integration, click ⠇**> Delete**. A confirmation popup window appears.

1. Click Yes.

Additional integration actions

In addition to finding, editing, or deleting integrations, you can perform other tasks to manage integrations from the Apono UI.

View associated integration resources

Follow these steps to view the associated integration resources:

1. Find an integration.

2. In the row of the integration, click ⠇**> Resources**. A page of the integration's resources appears.

Refresh an integration

Follow these steps to refresh an integration:

1. Find an integration.

2. In the row of the integration, click ⠇**> Refresh**. Apono syncs the integration.

\

Many integrations require granting Apono connector credentials to allow it to authenticate and connect. You can create secrets in different secrets managers (e.g. AWS, GCP, Azure) and specify them in the integration secret store. This allows the connector to safely and securely retrieve its credentials in order to connect to the desired integration resources.

Apono supports the following secret managers:

kubectl create secret generic <SECRET_NAME> --from-literal=<KEY1>=<VALUE1> --from-literal=<KEY2>=<VALUE2>

kubectl label secret <SECRET_NAME> "apono-connector-read=true"

helm upgrade apono-connector apono-connector --repo https://apono-io.github.io/apono-helm-charts \
    --set-string apono.token=<APONO_TOKEN> \
    --set-string apono.connectorId=<CONNECTOR_NAME> \
    --set serviceAccount.manageClusterRoles=true \
    --set allowedSecretsToRead={secret1\,secret2\,secret3} \
    --namespace apono-connector 

terraform {
  required_providers {
    kubernetes = {
      source = "hashicorp/kubernetes"
      version = "2.32.0"
    }
    helm = {
      source = "hashicorp/helm"
      version = "2.15.0"
    }
  }
}

provider "helm" {
  kubernetes {
    config_path = "~/.kube/config"
  }
}

resource "kubernetes_secret" "apono-k8s-secret" {
  metadata {
    name = "<SECRET_NAME>"
    namespace = "<NAMESPACE>"
    labels = {
      "apono-connector-read" = "true"
    }
  }

  data = {
    <KEY1> = "<VALUE1>"
    <KEY2> = "<VALUE2>"
  }
  
  type = "Opaque"
}

resource "helm_release" "apono-helm" {
  name       = "apono-connector"
  repository = "https://apono-io.github.io/apono-helm-charts"
  chart      = "apono-connector"
  namespace  = "<NAMESPACE>"

  set {
    name  = "apono.token"
    value = "<APONO_TOKEN>"
    type  = "string"
  }

  set {
    name  = "apono.connectorId"
    value = "<CONNECTOR_NAME>"
    type  = "string"
  }

  set {
    name  = "serviceAccount.manageClusterRoles"
    value = "true"
  }
  
  set {
    name  = "allowedSecretsToRead"
    value = "{secret1\,secret2\,secret3}"
  }
}

aws secretsmanager create-secret \
--name "<SECRET_NAME>" \
--tags '[{"Key":"apono-connector-read","Value":"true"}]' \
--region <REGION> \
--secret-string '{"KEY1":"VALUE1","KEY2":"VALUE2"}'

resource "aws_secretsmanager_secret" "<SECRET_NAME>" {
  name = "<SECRET_NAME>"
  // This tag allows the Apono connector role to read the secret with predefined policy 
  tags = {
    "apono-connector-read" = "true"
  }
}

resource "aws_secretsmanager_secret_version" "<SECRET_NAME>" {
  secret_id     = aws_secretsmanager_secret.<SECRET_NAME>.id
  secret_string = jsonencode({
    KEY1 = "VALUE1",
    KEY2 = "VALUE2"
  })
}

az keyvault secret set \
--vault-name "<KEYVAULT_NAME>" \
--name "<SECRET_NAME>" \
--value '{"<KEY1>": "<VALUE1>", "<KEY2>": "<VALUE2>"}'

data "azurerm_key_vault" "<KEY_VAULT>" {
  name                = "<KEY_VAULT_NAME>"
  resource_group_name = "<KEY_VAULT_RESOURCE_GROUP_NAME>"
}

resource "azurerm_key_vault_secret" "<SECRET_NAME>" {
  name         = "<SECRET_NAME>"
  value        = '{"<KEY1>": "<VALUE1>", "<KEY2>": "<VALUE2>"}'
  key_vault_id = azurerm_key_vault.<KEY_VAULT>.id
}

gcloud secrets create <SECRET_NAME> \
    --replication-policy="<REPLICATION-POLICY>" \
    --data-file=-

gcloud secrets versions access 1 --secret='{"KEY1":"VALUE1","KEY2":"VALUE2"}'

resource "google_secret_manager_secret" "<SECRET_NAME>" {
  secret_id = "<SECRET_NAME>"

  replication {
    <REPLICATION-POLICY>
  }
}

resource "google_secret_manager_secret_version" "<SECRET_NAME>-version" {
  secret = google_secret_manager_secret.<SECRET_NAME>.id

  secret_data = '{"KEY1":"VALUE1","KEY2":"VALUE2"}'
}

HASHICORP_VAULT_CONFIG='[{"address":"http://HASHICORP_VAULT_URL","token":"HASHICORP_VAULT_TOKEN"},
{"from_secret_store": "AWS", "region": "AWS_REGION", "secret_id": "AWS_SECRET_ID",},
{"from_secret_store": "GCP", "project": "GCP_PROJECT_ID", "secret_id": "GCP_SECRET_ID"},
{"from_secret_store": "AZURE", "AZURE_KEY_VAULT_URL": "vault_url", "name": "SECRET_NAME"},
{"from_secret_store": "KUBERNETES", "NAMESPACE": "namespace", "name": "SECRET_NAME"}
]'

Cloud computing has become an essential tool for businesses of all sizes. As a provider of many services and tools, Amazon Web Services (AWS) is a cloud environment supported by Apono.

The articles in this section will help you connect Apono with your AWS-based resources so that you can effectively manage permissions to these resources.

Active-active availability refers to a high availability (HA) architecture, where two or more systems are actively handling requests simultaneously.

HA can provide the following benefits:

• Provide redundancy by maintaining operations during downtime

• Distribute requests across multiple active systems to improve load balancing

• Maximize resource use by employing standby systems

• Reroute traffic through automatic failover to the remaining active system

Apono leverages HA to guarantee uptime to customers. Our on-premise connector can be deployed with several instances. If one instance is down, HA ensures that others are available to continue provisioning.

Prerequisite

Deploy HA connector instances

For HA, you can add instances to an existing connector using the same connector ID.

Follow these steps to add a connector instance for high availability:

1. From the Connectors page, click Install Connector. The Install Connector page appears.

2. Select Cloud Installation.

3. Select a platform for the connector. The permission options appear.

4. Select a permissions option.

5. Select an installation method.

1. In the connector installation module, configure the connector ID parameter to share the same value as an existing connector ID in the environment. You can find the connector ID of an existing instance on the Connectors page.

module "connector" {
    source = "github.com/apono-io/terraform-modules/azure/connector-with-permissions/stacks/apono-connector"
    aponoToken = $APONO_TOKEN
    connectorId = $EXISTING_CONNECTOR_ID
    resourceGroup = $AZURE_RESOURCE_GROUP
    ipAddressType = // "Private" or "None"
    subnetIds = [$SUBNET_ID]
}

1. Complete the installation of the connector in your environment (AWS | Azure | GCP | Kubernetes).

Upon completion, you can integrate your HA connectors with your environment.

Periodically, you may need to update your AWS connector to help maintain functionality, performance, and security.

This article explains how to update a connector through the AWS CLI and redeploy the CloudFormation stack with the latest connector template.

Prerequisites

Update a connector

Follow these steps to update a connector:

1. Copy the following Account level or Organization level AWS update script. Be sure to replace AWS_STACK_NAME with your AWS stack name.

1. At your AWS CLI prompt, enter the updated script from the previous step to initiate the update. The AWS CLI will return an object containing the StackId.

2. In CloudFormation, on the Stack Info tab, confirm that the update has completed:

   2. Under the Stack name column, click the stack name.

   3. On the Stack info tab, check the Status.

Troubleshooting

This section details common errors that can occur during the updating process. If an error occurs that is not listed below, please contact your Apono representative.

Overview

To integrate with AWS and start managing JIT access to AWS cloud resources, you must first install a connector in your AWS environment.

The connector should match the level of access management you want to achieve with Apono: on a single account or on the entire organization.

• To manage access to a single AWS account, install a connector on that account. Follow .

• To manage access to all the accounts in the AWS organization:

  • Install a connector on the management account. Follow . OR

  • Install a connector in any account with ECS or EKS and give it delegated permissions to the management account. Follow .

How to install the Connector

First, decide if you want to integrate Apono with a specific AWS Account or with the entire Organization (containing multiple Accounts).

Now, follow one of the guides below depending on your selection:

AWS Account Connector

Prerequisites

• Administrator permissions to the AWS account you want to connect.

• VPC with outbound connectivity

1. In Apono

1. Login to the Apono platform

2. Go to the Apono Integrations page

3. From the Catalog, pick AWS

2. In CloudFormation

1. Choose Cloudformation

2. Click "Open Cloud Formation"

3. Sign in to your AWS user and click Next

1. Within the AWS create stack page, scroll down

2. Make sure you pick at least one Subnet and one VPC from the dropdown lists

3. Tick the acknowledge box and then select Create Stack

Apono integrates with AWS natively, using AWS CloudFormation as a standard mechanism to deploy all required configurations including a Cross Account Role with Read permission, a SNS notification message, and the Apono Connector that runs using an AWS ECS on Fargate.

AWS Organization Connector on the management account

Prerequisites

• Administrator permissions to the AWS management account in the Organization.

• VPC with outbound connectivity.

1. In Apono

1. Login to the Apono platform

2. Go to the Apono Integrations page

3. From the Catalog, pick AWS

2. In CloudFormation

1. Click "Open Cloud Formation"

2. Sign in to your AWS user and click Next

1. The new stack should be installed in the management account (which manages the organization's Identity Center)

2. Within the AWS create stack page, scroll down

3. Make sure you pick at least one Subnet and one VPC from the dropdown lists

4. Tick the acknowledge box and then select Create Stack

Apono integrates with AWS natively, using AWS CloudFormation as a standard mechanism to deploy all required configurations including a Cross Account Role with Read permission, a SNS notification message, and the Apono Connector that runs using an AWS ECS on Fargate.

Connector with delegated permissions to the AWS management account

Prerequisites

• Administrator permissions to the AWS management account in the Organization

• For EKS: admin permissions on the cluster

Step 1: Deploy a connector in an AWS account

Using CloudFormation (ECS)

1. Open the CloudFormation in the member account you want to deploy at.

2. Fill the SubnetIDs, VpcId parameters

3. Create stack, and wait to finish

4. Copy the connector role from the "Outputs" tab

Using Helm (EKS)

2. Set the following environment variables, to set the AWS Role for the connector deployed in EKS.

Where:

AWS_ACCOUNT_ID is the account where the EKS deployment is hosted

AWS_ROLE_NAME is the role defined for the connector in step 1

CONNECTOR_TOKEN is the token generated in the Apono UI when creating a new connector

[block:image] { "images": [ { "image": [ "https://files.readme.io/78e94c2-image.png", null, "" ], "align": "center", "sizing": "300px" } ] } [/block]

CONNECTOR_ID is the connector name. Set any name of your choosing.

1. Run the following helm command to deploy the connector

1. Copy the role given to the connector (arn:aws:iam::$AWS_ACCOUNT_ID:role/$AWS_ROLE_NAME)

Step 2: Deploy roles in the Management Account (assumable by the connector)

2. In "ConnectorRoleArn" parameter, paste the connector role from the previous step.

3. Fill the "OrganizationalUnitId" parameter.

4. Create stack, and wait to finish.

5. Copy the Management Account Role ARN from the "Outputs" tab.

Results

Verify that the Stackset was created successfully and that Cloudformation finished.

Then, In the Apono app, you will see the connector was found and a green checkmark indication.

If your organization uses Amazon Web Services (AWS) as a cloud platform, Apono's AWS integrations can help you securely manage access to your AWS cloud-based services and databases.

By identifying and transforming existing privileges, Apono can shift your cloud management from broad permissions to on-demand access flows.

Through our AWS integrations, Apono enables you to perform the following access tasks:

• Limit Access: Discover existing cloud privileges and convert them to just-in-time access flows.

• Enable Self-Service Access: Allow developers to request access to AWS services, buckets, and instances via Slack.

• Automate Approval Workflows: Create automatic approval processes for sensitive AWS resources.

• Restrict Third-Party Access: Grant third-parties (customers or vendors) time-based access to specific S3 buckets, RDS, or EC2 instances with MFA verification.

• Review Access: Audit user cloud access, permissions granted, and reasons for access across AWS.

Connectors are secure on-prem components that link Apono and your resources:

• No secrets are read, cached, or stored.

• No account admin privileges need to be granted to Apono.

• The connector contacts your secret store or key vault to sync data or provision access.

Once set up, this connector will enable you to sync data from cloud applications and grant and revoke access permissions through Amazon Elastic Container Service (ECS).

Prerequisites

Install a connector

Use the following steps to install an Apono connector for AWS on ECS:

1. At the shell prompt, define an environment variable named TF_VAR_APONO_TOKEN with your Apono token value.

1. At the Terraform CLI, download and install the provider plugin and module.

1. Apply the Terraform changes. The proposed changes and a confirmation prompt will be listed.

1. Enter yes to confirm deploying the changes to your AWS account.

FAQ

Apono offers AWS users a simple way to centralize cloud management through our platform. Through a single integration, you can manage multiple AWS services across various accounts and organizations.

Integrate an AWS account

Prerequisites

• installed in your AWS account

• To sync and manage access to EC2 servers, make sure you add the AmazonSSMManagedInstanceCore policy to the connector's IAM role

Integration

Follow these steps to integrate Apono with your AWS account:

2. Under Discovery, click Amazon Account.

3. Click one or more resource types to sync with Apono.

1. Click Next. The Apono connector section expands.

2. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.
3. Click Next. The Get more with Apono section expands.

4. Define the Get more with Apono settings.
5. Click Confirm.

After connecting your AWS account to Apono, you will be redirected to the Connected tab to view your integrations. The new AWS integration will initialize once it completes its first data fetch. Upon completion, the integration will be marked Active.

Integrate an AWS organization

Prerequisites

• To sync and manage access to EC2 servers, make sure you add the AmazonSSMManagedInstanceCore policy to the connector's IAM role

Integration

Follow these steps to integrate Apono with your AWS organization:

2. Under Discovery, click Amazon Organization.

3. Click one or more resource types to sync with Apono.

1. Click Next. The Apono connector section expands.

2. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.
3. Click Next. The Get more with Apono section expands.

4. Define the Get more with Apono settings.
5. Click Confirm.

After connecting your AWS account to Apono, you will be redirected to the Connected tab to view your integrations. The new AWS integration will initialize once it completes its first data fetch. Upon completion, the integration will be marked Active.

Troubleshooting

📘 You have chosen the advanced installation method

You can also easily connect AWS in Apono following this UI guide

How to install the Connector on EKS Using Terraform

Prerequisites

• Required CLI: terraform

Step 1 - Create Connector

• Login to Apono and create connector in the

Important: before you start, copy the connector Terraform params and export them in the terminal.

Step 2 - Configure Variables

Step 3 - Add necessary Terraform providers

** if you already use your own providers, you can skip this step

Run terraform init to validate it works

Step 4 - Add EKS cluster OIDC provider to your IAM

It's required that your EKS cluster OIDC provider will be added to your IAM. This step is required only once, and you may have already done it.

Step 5 - Create the Connector IAM role

The Connector is deployed using helm and requires an IAM Role to be able to access tagged ASM secrets in the future.

Step 6 - Deploy Apono Connector

Validate the Connector is Connected

EC2 via Systems Manager Agent (SSM)

Intro

This integration provides the ability to grant users permissions to connect to the EC2 with a secure connection - SSM.

Prerequisites

• An integration between Apono and the AWS Organization or Account where the EC2 is.

• EC2 machine with SSM agent installed. Installed by default in most EC2s docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent

• End users will need to install the session manager plugin for AWS CLI on the local user's computer. docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin

Step-by-step guide

The EC2 instance role

Follow the steps below to create an EC2 instance role with the AmazonSSMManagedInstanceCore managed policy. Read more here.

1. In the AWS IAM, Click Create new IAM Role

   1. Click Create Role

   2. Choose the AWS Service option

   3. From the dropdown list, choose EC2

   4. Choose EC2 Role for AWS System Manager. Click Next.

   5. Verify that the AmazonSSMManagerInstanceCore policy is added. Click Next

   6. Fill the Role name box (for example, ec2-ssm)

   7. Click Create role

2. Go back to the Modify IAM Role page

   1. From the dropdown list, choose the new IAM role we created (ec2-ssm)

   2. Click Update IAM role

   3. Pleas note: it takes about 30 minutes for the AWS sync to finish.

Integrating Apono with the EC2 instances

1. In the Apono UI, edit an existing AWS Org or AWS Account integration or create a new one.

2. Add the EC2 Connect resource type.

3. Complete the integration and click Integrate.

Results

Apono should now discover EC2 machines! You can now create access flows to EC2 instances.

In this article

Prerequisites Create AWS RDS MySQL Integration Next Steps

Amazon RDS for MySQL is an open-source relational database management service in the cloud. Through AWS RDS MySQL integration, you will be able to integrate with AWS RDS MySQL:

• Database

• Table

• Role

Prerequisites

• If you already have AWS Apono connector:

  • Make sure the connector's minimum version is 1.5.3.

• If you still don't have AWS Apono connector:

  • Install AWS Account connector on ECS using Terraform.

  • Install AWS Account connector on ECS using CloudFormation.

  • Install AWS Organization connector on ECS using Terraform.

  • Install AWS Organization connector on ECS using CloudFormation.

  • Install AWS Organization connector on EKS using Terraform.

• AWS command-line

• MySQL command-line

Create AWS RDS MySQL Integration

Generate Credentials

Create user and grant permissions:

aws rds describe-db-instances \
  --filters "Name=engine,Values=mysql" \
  --query "*[].[Endpoint.Address,Endpoint.Port]"

mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -p

mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -p

CREATE USER 'USER_NAME'@'%' IDENTIFIED BY 'PASSWORD';

GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';  
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON mysql.* TO 'USER_NAME'@'%';

aws rds describe-db-instances \
  --filters "Name=engine,Values=mysql" \
  --query "*[].[DBInstanceIdentifier,Endpoint.Address,Endpoint.Port]"