Just-in-time AWS access

The problem

Forty-two engineers held permanent AdministratorAccess across 30 AWS accounts. Offboarding took days, and auditors flagged every quarter that nobody could say who had touched production.

Why it matters

Standing admin is the access a phished laptop or leaked token inherits. Removing it shrinks the blast radius of a stolen credential from every account to one role for one hour, and it turns the SOC 2 access review from a spreadsheet exercise into a query.

How it works

An engineer runs /elevate prod-payments ReadOnly 1h in Slack. A Step Functions workflow checks the request against policy, posts it to the owning team’s channel for approval, then creates a temporary permission-set assignment in IAM Identity Center. A scheduled step removes the assignment when the window closes, whether or not anyone remembers.

Every request, approval and AWS API call shares one correlation ID, so a single Athena query answers “who did what in production last Tuesday, and who approved it.”

Decisions worth explaining

• Permission sets over IAM users. Identity Center assignments are scoped, expire cleanly, and disappear when Okta deprovisions the person.
• Break-glass stays, behind two people. Two hardware-key-protected root-equivalent roles exist for the day Okta is down. Using one pages the security channel.
• Read-only needs no approval. Engineers get it instantly, which removed most of the pressure to keep admin “just in case.”

What I’d do next

Push the same pattern to Kubernetes RBAC with short-lived kubeconfigs issued from the same workflow.