Opal + AWS IAM Roles

Product Overview

An IAM role is an IAM identity that you can create in your account that has specific permissions. An IAM role is similar to an IAM user, in that it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS. However, instead of being uniquely associated with one person, a role is intended to be assumable by anyone who needs it. Also, a role does not have standard long-term credentials such as a password or access keys associated with it. Instead, when you assume a role, it provides you with temporary security credentials for your role session.

Integration Overview

Developers can easily discover and request for just-in-time short-lived access for IAM roles. Additionally, developers can request for the creation of new IAM roles. All access is granted through attributable federated IAM sessions. With Opal, engineers can access roles via AWS web console or command line.

Use cases

1. Modern Access Management

Using Opal, customers can:

• Grant just-in-time access to critical resources that are auto-expiring and fully audited
• Enable resource owners with the most context to approve access requests and provision access automatically via Slack
• Ensure that privileged roles have the appropriate identity governance and approval configurations, such as multi-stage approvals, max duration, custom fields, and more
• Automate user access reviews so compliance teams can snapshot user listings, assign reviewers to self-service reviews, propagate access changes, and generate an auditor-friendly access report
• Automatically escalate privileges (and revoke access) when developers are on-call via integrations with PagerDuty and Opsgenie

2. Privileged Access Management

To support native developer workflows, Opal has:

• Easy way for developers to start sessions via the web or CLI
• Native IAM role generation natively within the product
• Audit logs for user attribution

Integration Setup

EC2 can be imported using Opal's AWS connectors.

1. In the Apps sidebar, click on "New App", and select Amazon Web Services

2. Opal requires an IAM user to manage your AWS Cloud on your behalf. To simplify the process of creating a user with the proper IAM policies, you can use our official CloudFormation Stack to automatically generate one.

3. Once the user is created, admins just need to fill out the form to add user access key ID and user secret access key.

‍