Some feedback on a production access control software for the cloud. (AWS)

Hi IndieHackers,

I have been working on the cloud since the past 2 years and I regularly come across this challenge where we have to ask someone for access to their AWS or GCP account. Mostly we are granted the following types of access -:

1. You are granted perpetual admin access since the account owner

2. does not understand permissions

3. trusts you

4. Is too lazy grant you a set of permissions.

5. You get what you ask for. This is good to begin with but soon begins to hinder you. Soon you will require more permissions than what you have been granted and you will start asking the IAM admin to give you one more permission and then one more and then one more. How this cycle works is that you ask for a permission on Slack or create a JIRA ticket. The IAM admin grants you permissions in some time. And then God forbid if you get one permission less, you again need to ask for access and there goes the cycle again.

6. You get viewer access to begin with. This is the safest option where there is no proper automation or management of the IAM. You ask for permissions as you require and there goes the cycle again.

One another caveat with granting permissions manually is that it is prone to errors and takes up a lot of time on the part of the admin.

So people have started automating the above using tools like terraform. The permissions are kept inside a git repository and people are asked to create pull requests on the master branch. Once the pull request is approved the permissions are granted. This brings some structure to the flow of granting permissions and is being adopted in big organisations today.

But one caveat with the above model is that it does not work for production access that easily. Production access is critical access and should not be granted to everyone. However in teams today, all members of team support the application in rotation and will require production access during their support day or week. So what ends up happeniing is that everyone has production access.

What I was thinking is to build is a platform around automation of the request and approval of access to the cloud. To begin with, I have started working with AWS. What this platform does is -

1. Allows a user to request access for a specified time period.
2. Allows an approver to grant access.
3. Automatic revocation of access after the specified time period elapses.
4. Restricts requests to a predefined set of permissions.
5. Support for organisastions and teams.
6. Support for custom set of permissions
7. Allows login to the cloud account without generating permanent credentials.(AWS)
8. Allows management of multiple cloud accounts.

This will streamline the access approval flow and will also ensure the principle of least privilege.

The website is at https://classicops.com

Looking forward to your feedback.

Cheers!