⬇️Getting Started with Just-in-Time Access
Install P0 Security, configure approval workflows, and make your first just-in-time access request. A step-by-step guide for security and DevOps teams.
Visual overview
The following diagram illustrates an example Just-in-Time Access workflow at a high level.
Steps to get started
This guide provides the following sections to help you get up and running with P0's Just-in-time access:
This process takes about 15 minutes.
This document uses the following terms:
Requestor: Person who requests access to a resource via P0's Slack bot.
Approver: Person who approves these access requests via P0's Slack bot.
Set up an account and a security reviewer
To create your P0 account and set up an approver to approve access requests:
Create a free P0 account at https://p0.app/create-account. All you need is an email address.
Set up a cloud integration through the guided onboarding flow (select Access Orchestration). You may skip this step and instead follow the instructions to install a resource in the next step.
Once you complete the onboarding, under P0 Management, add one or more "Security Reviewers". Security Reviewers can approve access requests.
To further configure access request requesters, approvers, or change settings such as the ability to approve your own access requests, navigate to Policy Studio (or go to https://p0.app/o/<your organization>/policies). You can edit the existing default rule or create new rules.
Install P0 on an IAM resource
If you already configured a resource as part of the guided onboarding, you may skip this step. Otherwise, you will need to install an IAM resource to which users can request Just-in-time access.
To do this, navigate to Integrations and select the integration you wish to install from the list of "Resource" integrations.
Once you have selected a resource, follow the instructions in the app to provide P0 with permissions to grant and revoke access on that resource via the IAM Management installation. For more information, follow one of the resource-specific installation guides below.
☁️Google Cloud📦AWS❄️Snowflake☸️KubernetesMake your first access request
Once you've set up P0, you can make your first access request. You can try this out entirely on your own, if you enabled one-party approvals in Set up an account and a security reviewer. Otherwise, grab a colleague to help you, and designate one person as the requestor and the other as the approver:
You can use the P0 Security Command-line Interface (CLI) as an alternate method to request permissions, and then approve using the P0 website app.
P0 is in the process of adding additional IAM request methods, including a Microsoft Teams bot.
Navigate to any page under Access Management
https://p0.app/o/<your organization>/access-management/activityand click the Request Access button in the top right.
Populate the request details. For example:
The approver can see the request on the Access Management Activity page in the Pending section.
After a few moments, the access requestor receives a notification in the p0-requests channel that access was granted.
Most IAM systems have a delay of around 10 to 30 seconds after access is configured before access propagates to the resource and usage is enabled.
Once the access propagates to the resource, the request progresses to the Active section.
Access automatically ends after the expiration period is over, or when the requestor clicks the Relinquish button in their P0 DM.
Have the requestor open Slack, navigate to the p0-requests channel, and enter
/p0 requestin the Slack channel:
Populate the request details. For example:
The approver receives a Slack notification via a DM from P0 Security. Navigate to that DM chat, choose an expiration, and click Approve.
After a few moments, the access requestor receives a notification in the p0-requests channel that access was granted.
Most IAM systems have a delay of around 10 to 30 seconds after access is configured before access propagates to the resource and usage is enabled.
Once the access propagates to the resource, the requestor can validate the access.
Access automatically ends after the expiration period is over, or when the requestor clicks the Relinquish button in their P0 DM.
What's next
If you run into any issues, reach out to support@p0.dev for assistance.
Now that you can make access requests, you can:
Connect P0 to your directory
Add auto approvals
Start using P0's Inventory & Posture capabilities
Configure access policies to route, automatically approve, and automatically deny requests based on the requester and resource
Last updated