Dar acceso a alguien en AWS es un problema que todo el mundo resuelve mal. La opción fácil es compartir la contraseña de la cuenta, con todo lo que eso implica. La correcta es crear un usuario de IAM y escribirle una política con las acciones y los recursos exactos, en un lenguaje que hay que aprender y que un error convierte en "acceso total" o en "no funciona nada". Y cuando esa persona se va, hay que acordarse de borrarla, en cada cuenta.
En Simplio los permisos son casillas: para cada usuario, qué acciones puede hacer (ver, arrancar y parar, instantáneas, ficheros, bases de datos, dominios, terminal…) y sobre qué objetos: estas máquinas, este bucket, esta cuenta. El colaborador ve una máquina. El cliente de la agencia ve su cuenta y ninguna más. Nadie recibe una clave de AWS, porque la cuenta está conectada una sola vez, por el administrador.
How it works
You create the user in Simplio
Name and email. The person receives their access and enables their two-factor, if you want to require it. They don't need an AWS account.
You tick what they can do
The actions, grouped by what they are: view, start and stop, firewall, snapshots, files, databases, email, domains, functions, terminal, costs… Each one is a checkbox.
You tick on what
The machines, buckets, databases and accounts those actions reach. What isn't ticked doesn't exist for that person: not in the list and not in searches.
You change or remove it whenever you want
If a person leaves the company, their user is deactivated and they lose everything at once, in all accounts. Every permission change goes into the activity log.
How secure it is
No AWS key is passed around
The AWS account is connected once, by the administrator, with a permission limited to what Simplio does. Users use Simplio, not AWS.
What isn't granted isn't seen
Permissions are enforced on the server, on every query: a user without permission on a machine doesn't see it, even if they know its name or address.
Two-factor per user
It is enabled person by person, and sensitive actions always require it, administrators included.
Every permission change is logged
Who granted what to whom and when. If someone has access to something, you know why.
The same task, in AWS and in Simplio
| On your own in AWS | In Simplio | |
|---|---|---|
| Give a technician a single machine | IAM user, JSON policy with the instance's ARN, tag condition, test that it works | Checkboxes: the action and the machine |
| Give a customer their account | An IAM user in that account, or a role in the organisation | Account checkbox on their Simplio user |
| Remove access from someone who leaves | Find their users in every account and delete them | Deactivate their Simplio user |
| Know who has access to what | Read IAM policies | The user's profile page |
Frequently asked questions
Do Simplio users need an AWS account?
No. Only the administrator connects the AWS account, once. The rest sign in to Simplio with their user and their two-factor.
Can a user give themselves more permissions?
No. Permissions are granted by whoever has the permission to manage users, and every change is logged.