Before
SOC analysts received access requests through Slack, then manually identified the requester, selected the correct cloud account and permission set, and configured the assignment in the single sign-on administration system. They also had to track whether access was short- or long-lived, remember the expiration time, revoke permissions across each account, and notify the requester and team.
How it works
- Receive the access request, identify the Slack user, resolve the requested accounts and permission set, and prepare the notifications.
- Grant the permission set across each requested account, select the one-hour or eight-hour authorization window, and notify the requester and team in Slack.
- After the window expires, remove the assignment from each account and send revocation updates in Slack.
Workflow details
- Request intake and identity resolution: A webhook receives an access request submitted by an authorized employee through Slack. The workflow identifies the requester from the Slack user directory, resolves the corresponding principal, locates the requested cloud accounts and permission set, and prepares the account details for status messages.
- Temporary access assignment: The workflow processes each requested account individually and assigns the selected permission set to the requester through the cloud single sign-on administration service. It also posts a channel update and sends the requester a direct message confirming the granted access and the requested reason.
- Duration-based control: The workflow checks whether the request specifies a short or long authorization period. Short access remains active for one hour, while long access remains active for eight hours before the cleanup process begins.
- Automatic access removal: After the selected authorization window expires, the workflow iterates through the requested accounts, removes the principal's permission assignment from each account, and sends Slack notifications indicating that the access has been revoked.
What changed
Access is now assigned and removed on a defined schedule for every requested account, with identity and permission lookups, duration handling, cleanup, and Slack notifications performed automatically. Human oversight can remain focused on approving or submitting the request rather than executing and tracking each access change.
Work removed
Manually looking up the requester, matching users to principals, finding account and permission-set identifiers, assigning permissions account by account, tracking expiration times, revoking assignments, and sending grant and revocation notifications.
Expected outcome
A conservative estimate is about five recurring manual actions removed per access request, while temporary permissions are scheduled for revocation after one or eight hours instead of relying on manual follow-up.
