📦Access Bundles
Group several resource accesses into a single requestable Access Bundle in P0 Security, so users request everything they need for a task in one step.
An Access Bundle groups multiple resource accesses into a single requestable item. Instead of filing separate requests for an AWS role, a Google Cloud role, and a Kubernetes namespace, a user requests one bundle and P0 provisions every resource in it after approval.
Bundles are useful when a task consistently requires the same set of permissions across integrations, for example onboarding an engineer to a service or granting a standard "incident responder" access set.
Access Bundles are in beta. The feature and its interface may change.
How Access Bundles work
An Owner creates a bundle in Policy Studio and adds 2-15 resources from your installed integrations.
A user requests the bundle from the web app or Slack.
P0 routes the request to the approvers configured on the bundle.
After approval, P0 provisions every resource in the bundle through its own integration.
Access expires after the requested duration, the same as any other just-in-time request.
Each item in a bundle keeps the access behavior of its underlying integration. A bundle is a way to request several accesses together, not a new kind of grant.
Prerequisites
Before you begin, confirm the following:
The Owner role in your P0 organization (required to create and manage bundles).
At least two resource integrations installed and configured, so the bundle has resources to include.
Create an Access Bundle
Open the Access Bundles view
Sign in to p0.app.
Navigate to Policy Studio in the sidebar.
Select Access Bundles in the category control at the top of the page.
You see a list of existing bundles. The list is empty the first time you open it.
Start a new bundle
Click Create Bundle.
The bundle editor opens with three sections: Identity, Resource(s), and Actions. Configure each one in order.
Enter a name for the bundle in the name field at the top (for example, "Incident responder").
Access Bundles are edited only in the visual editor. Unlike access policies, they can't be edited as YAML.
Define who can request the bundle
The Identity section specifies which users can request this bundle.
In the Identity section, select one of the following:
Any: Any user in your organization can request the bundle.
User: A specific user or directory group can request the bundle.
If you selected User, choose a specific user's email address or a directory group.
Add resources to the bundle
The Resource(s) section defines what the bundle grants. A bundle must contain at least 1 and at most 15 resources.
Click Add to Access Bundle.
Select the integration for the resource (for example, AWS, Google Cloud, or Kubernetes).
Select the access type and the specific resource for that integration.
Repeat for each resource you want to include. Resources are grouped by integration in the editor.
If you add the same resource and access type twice, the editor flags the duplicate and excludes it from the saved bundle.
Define how requests are approved
The Actions section specifies how P0 handles requests for the bundle. This works the same way as approvals on an access policy.
Select an approval type (for example, P0, Group, or Auto).
Configure approval options as needed, such as Require reason with request.
If you don't configure an approval, P0 routes bundle requests to your configured Security Reviewers by default.
Save the bundle
Review the bundle across all three sections.
Click Create Access Bundle.
The bundle appears in the Access Bundles list with the Enabled toggle turned on. It is now available for users who match the identity you configured.
Request an Access Bundle
Users request a bundle the same way they request any other resource, by selecting Access Bundle as the resource type. Bundles can be requested from the web app and from Slack.
Request from the web app
Open the P0 app and navigate to Access Management.
Click Request Access.
Select Access Bundle as the resource, then select the specific bundle.
Set the duration and, optionally, a reason.
Submit the request for approval.
Request from Slack
If your organization has installed the Slack integration, type /p0 request and select Access Bundle in the request modal, then choose the bundle to request.
For more ways to request access, see Requesting Access.
Manage bundles
From the Access Bundles list, an Owner can:
Edit a bundle: Click a bundle row to open the editor and change its identity, resources, or approval.
Disable a bundle: Turn off the Enabled toggle. Disabled bundles aren't available for requests.
Delete a bundle: Click the delete icon on the bundle row. This action can't be undone.
Related
Configure your first access policy: Control who can request individual resources and how those requests are approved.
Requesting Access: All the ways users can request access in P0.
Approving Access: How approvers review and manage requests.
Last updated