Access
Give access only when it's needed.
Engineers request time-bound access to cloud accounts, databases, clusters, servers and GitHub. It is approved, it expires on its own, and everything is recorded.
Nothing extra on this page
Just-in-time team access
Access governance and activity
- 01An engineer asks for time-bound access
- 02Approved before it starts
- 03The session is recorded while it runs
- 04Removed automatically when time is up
orders-db
Read only · 1 hour
Reason: slow checkout queries
Example data.
Time-bound access
My Access, Request Access, Team Access
People ask for access in Request Access, owners approve it in Team Access, and everything a person holds is in My Access.
See Time-bound access in detailDatabase Access
Grant a teammate scoped, time-boxed access to a database. A temporary role is created on the database and dropped automatically when it expires or you revoke it.
VM / SSH Access
SSH without shared keys. Install a server's certificate authority once; granting access signs the teammate's key into a short-lived certificate that expires on its own.
Kubernetes and OpenShift Access
Also here: Kubernetes Access
With Kubernetes Access and OpenShift Access, a pod inside the cluster, with just enough RBAC, hands out kubeconfigs that expire on their own. No static cluster credentials, and the cluster API stays private.
kubectl get pods -n payments
Deploy Access
A deploy to an environment that needs approval requires a one-time pass: request it, someone who may approve access signs off (Owners and Admins by default), and only that service is deployed for a bounded window.
Slack and Linear Access
Also here: Slack Access
With Slack Access and Linear Access, add a contractor to a channel or a team for the length of their project. They are removed automatically when it expires or when you offboard them.
#incident, 7 days
Platform team, 30 daysPermission Profiles
Build exactly the access a role needs: pick services, pick a level and scope it to resources. Zaysa writes the cloud policy for AWS, Google Cloud, Azure or DigitalOcean.
Cloud policy written for you
Runs inside your network
Connections, Connectors, Security events
Connections set which GitHub organisations and cloud accounts can be granted.
See Runs inside your network in detailEvery session recorded
Terminal sessions are recorded and kept for 60 days, so you can see who did what, and when.
Access Map and Access Activity
The Access Map shows every person and every system they can reach, and lets you recertify each grant: keep it or revoke it.
See Access Map and Access Activity in detailIntelligence
Ask one question about access, sessions and cloud changes and get a single cited timeline, instead of reading Access Activity and Cloud History separately.
Standing Credentials
Also here: Standing GitHub Access
Long-lived access that a time-bound grant cannot reach: AWS access keys, console logins and cross-account roles. Standing GitHub Access does the same for members and outside collaborators of your GitHub organisations. Each one is tied to a person and flagged when its owner has left.
Offboarding
Remove a person's access across every system in one step, then review the resources and cost they leave behind. Running infrastructure is never stopped; you reassign or retire it yourself.
More in Zaysa
See what you run, and what it costs.
Free plan, no card needed.