🖐️Requesting Access
Request just-in-time access to cloud resources using P0.
Need temporary access to a cloud resource? P0 lets you request time-limited access that's automatically provisioned after approval and revoked when it expires.
You can request access through any of these methods:
How access requests work
You request access to a specific resource, role, or permission.
P0 routes the request to the appropriate approver based on your organization's policies.
An approver reviews and approves (or denies) the request.
P0 provisions access automatically and notifies you.
Access expires after the approved duration, or you relinquish it early.
Most IAM systems have a propagation delay of 10-60 seconds after access is provisioned before you can use it.
Request via Slack
If your organization has installed the Slack integration, you can request access directly from Slack.
Using the Slack request modal
Open the interactive modal to discover available resources and access modes:
Type
/p0 requestin any Slack channelOr click the Run Shortcut icon in the message draft bar, then search for and select Request access
Select a resource and access type, then fill out the remaining fields. You may skip optional fields.
The "reason" field is optional, but highly recommended. Filling this out helps your request get approved more quickly.
Once you've filled out all required fields, click Request. P0 then sends you a DM with details of your request.
Using Slack slash commands
If you already know what you need, use slash commands for faster requests:
Add --help to any command to see available options. You can also type an incomplete command (for example, /p0 request aws policy) to open a filled modal.
Request via Microsoft Teams
If your organization has installed the Microsoft Teams integration, you can request access by messaging the P0 Security bot directly in Teams.
Sending a request message
Open a direct message with the P0 Security bot and type your request. For example:
The bot presents an interactive card where you can fill in resource details, select an access type, and submit your request.
Supported commands
You can use the following commands when messaging the P0 Security bot:
request
Request access to a resource
ls
List available resources
help
Display available commands and usage
Type help to see the full list of available commands and options.
Request via the web app
Open the P0 app and navigate to Access Management.
Click Request Access in the header.
Fill in the resource, role, duration, and reason.
Submit for approval.
For a detailed walkthrough, see Web request modal.
Request via the CLI
The P0 CLI provides command-line access requests that integrate with your terminal workflow.
After installing and logging in, use these commands:
Request access to any supported resource
Request and assume an AWS IAM role
Request and assume an AWS Identity Center permission set
Request and establish an SSH session
Request Kubernetes access and configure kubeconfig
Use --wait with any request command to block until the system provisions access, then automatically execute the underlying tool command.
Discussing your request with approvers
After you submit a request, a message appears in your organization's P0 approval channel (in Slack or Microsoft Teams) asking for approval. Your approver may:
Approve or deny the request immediately
Respond in a thread to ask for more information
You can't approve your own requests unless you are a configured approver and your organization allows one-party approvals.
If your organization has configured automatic approvals and you meet the approval conditions (for example, you are on-call on a specified PagerDuty escalation policy), access is granted automatically.
Gaining access
After approval, P0 provisions access and notifies you. Propagation times vary by system:
AWS
10-15 seconds
Directories (Okta, Entra ID, Workspace)
Depends on SCIM propagation time
Google Cloud
30 seconds - 1 minute
PostgreSQL
Immediate
Snowflake
Immediate
Relinquishing access
Access expires automatically after the approved duration. If you finish early, click the Relinquish button in your P0 notification (in Slack or Microsoft Teams) or on the Access Management page in the P0 app to give up access. This helps avoid unintentional use of elevated permissions.
Request on behalf of someone else
You can submit access requests for a colleague or service account. See Request for another party.
Related
Approving access -- How approvers review and manage requests
Request routing -- How your organization controls who can request what
Pre-approving access -- Set up automatic approvals for specific scenarios
Last updated