1 of 1

Glossary

Commonly used Apono terms

Term

Meaning

A dynamic flow to manage and control access. The Access Flow, set by the admin, determines the: -Requester (the user or group of users) -Resource or bundle of resources -Permission or permissions -Approval flow (automatic or by approver) -Access duration

Visit the Access Flows page to see how easily an Access Flow definition is created with step by step instructions.

The Apono Access Graph maps your organization's access: which users, groups and service accounts can access which cloud resources and with which roles and permissions. The graph visualizes the access paths so that you know exactly how access is granted to resources, whether JIT, via group membership or with standing access. Learn more here.

Users request access to resources controlled by Apono's Access Flows using Slack, Teams or CLI. This Access Request is either automatically approved or sent to the flow's approver who must then either approve or reject it.

Every access request is fully logged and auditable.

Admins are users in Apono who integrate Apono with their environment and create and manage Access Flows.

A user, group of users, manager or shift member who have been listed on a specific Access Flow as those who must approve or reject an access request.

A bundle is a combination of resources and permissions, grouped together so that they can be easily requested and granted together.

Bundles are great for: -Dynamic management - Admins can create a bundle once and use it in different Access Flows with different requesters, approval flows, and access duration. -Ease of use - Requesters can request a bundle of access for the task or incident they are currently handling.

Connectors are very small apps added to a cloud service that allows secure data sync and access management functions to be run by Apono.

The person who has been granted access to a resource or resources according to an Access Flow and will actually be using it.

Identity Provider; A service that stores and manages digital identities. Companies use these services to allow their employees or users to connect with the resources they need. They provide a way to manage access, adding or removing privileges, while security remains tight. Read more here.

Your cloud integrations must be connected with Apono to sync data on identities, resources and permissions and to manage access just-in-time. See the Apono catalog for a complete list of supported integrations.

Just In Time refers to that part of the Access Flow that makes a resource available to a user only when they need it and only as long as it is needed. It is JIT, but it also means that access isn't left and forgotten and left available past the time it is used.

You might also have heard the terms short-lived access, ephemeral access or temporary access.

The type of action users can perform on a resource. Actions are usually grouped into roles; for example an Admin role usually contains all the possible actions, like read, write, delete, etc.

Some permissions are more powerful than other. For example, a write permission (which allows you to edit a resource) is more powerful than a read permission (which only allows you to view it).

Permissions are at the heart of the Least Privilege principal; permissions (especially strong ones/those that apply to sensitive or critical resources) should be kept to a minimum and be granted only upon need (just-in-time).

Role-based access control (RBAC) systems assign access and actions according to a person's role within the system. Everyone who holds that role has the same set of rights. Those who hold different roles have different rights. Read more here.

A resource is a cloud service or other instance that a user can gain access to. For example, repositories, servers, machines, buckets, databases, but also accounts, projects, folders, clusters, etc. Every cloud application artifact can be a resource, and if integrated with Apono - users can request and be granted access to it.

The permission determines which actions the user can perform on the resources.

The resource type is the family the resource belongs to. For example, every S3 bucket instance has a name and path, but all S3 Buckets belong to the S3 Bucket family.