Ctrlk
Sign up for FreeKnowledge Base
For the complete documentation index, see llms.txt. This page is also available as Markdown.

🔌Custom application

Grant just-in-time access to an internal application through a connector you deploy on AWS Lambda or Google Cloud Run. P0 invokes your connector to list, grant and revoke access, and never reads insid

The custom application integration is in preview. Contact P0 if you'd like to build a connector for one of your internal applications.

The custom application integration lets you bring just-in-time access to an application that P0 Security has no built-in integration for. You deploy a small connector on AWS Lambda or Google Cloud Run, register it in P0, and P0 calls it to list the access a requestor can ask for and to grant or revoke that access.

P0 treats the access your connector exposes as opaque. Your connector decides which policies exist and how each one is provisioned and removed. P0 carries the requestor, the approval and the timing, then invokes your connector at the moment access is granted and again when it expires or is relinquished.

How it works

  • You own the provisioning logic. P0 sends your connector a grant or revoke call. Your code decides how to apply it inside your system.

  • P0 never reads your target system. The integration has no read side, so P0 collects no inventory from your application. It only invokes the connector.

  • Requestors choose a policy. Your connector's list primitive returns the policies available for an application. A requestor selects one or more of these when they request access.

  • No long-lived credentials to store. P0 invokes AWS Lambda through your P0 AWS installation and Google Cloud Run through your P0 Google Cloud installation, so authorization uses IAM, not a stored secret.

This is a distinct integration from the Custom resource integration. Custom resource sends a standardized HTTP event to your endpoint on each grant and revoke. Custom application uses a connector that also lists the policies a requestor can select, which lets one connector expose several requestable policies.

Before you begin

You need:

  • A connector deployed as an AWS Lambda function or a Google Cloud Run service that implements the P0 custom application connector interface.

  • The matching P0 installation for the cloud your connector runs in:

    • For AWS Lambda, an installed P0 AWS integration whose role can call lambda:InvokeFunction on the connector function.

    • For Google Cloud Run, an installed P0 Google Cloud integration whose service account can invoke the connector service.

When you install the integration, P0 verifies that it can reach the connector by calling the connector's side-effect-free metadata endpoint. This probe confirms connectivity without touching your target system.

Install a custom application

  1. In the P0 app, go to Integrations and select Custom application under Resources.

  2. Select Add to register a new custom application, and give it an ID and a name. The name is what requestors see when they request access.

  1. Under Connector hosting, select where your connector runs:

Enter the details of your Lambda function:

Field
Description

AWS account ID

The AWS account the connector's Lambda function is deployed in.

Connector name

The name of the Lambda function that hosts your connector.

Connector region

The AWS region the Lambda function is deployed in.

P0 derives the function ARN from these values and probes the function to confirm it can invoke it. If the probe fails with an access-denied error, grant P0's role lambda:InvokeFunction on the function and retry.

For a full walkthrough of building and deploying the connector itself, see Deploying a connector to AWS Lambda.

Enter the details of your Cloud Run service:

Field
Description

GCP project ID

The Google Cloud project the connector's Cloud Run service is deployed in.

Connector name

The name of the Cloud Run service that hosts your connector.

Connector region

The region the Cloud Run service is deployed in.

P0 looks up the service's invocation URL and probes it to confirm it can invoke the service. If the service isn't found, finish deploying it and retry. If P0 can't read the service, verify your P0 Google Cloud installation.

For a full walkthrough of building and deploying the connector itself, see Deploying a connector to Google Cloud Run.

  1. Complete the setup. Once the reachability probe succeeds, the custom application is ready to request access through.

Request access

A requestor asks for access to a custom application in two parts:

  1. Application: which registered custom application to request through.

  2. Policy: one or more policies your connector's list primitive serves for that application.

When P0 grants the request, it invokes your connector with the selected policies. When the grant expires or the requestor relinquishes it, P0 invokes the connector again to revoke the same policies. For the requestor's side of this flow, see Requesting access.

Related links

PreviousRequesting Cloudflare access
NextDeploying a connector to AWS Lambda

Last updated