Skip to main content

Just-in-Time Access (JIT)

Cloudanix JIT starts from one premise: no standing privilege for anyone or anything. Access is requested for a task, granted for minutes, scoped tightly, fully recorded, and gone when the timer expires — for humans and machines alike.

The same request → approve → access → record → expire flow covers seven surfaces:

  • Cloud Console — time-boxed IAM roles in AWS, Azure, and GCP through your existing SSO. Low-risk reads auto-approve; production admin needs a named approver or a quorum.
  • Database — short-lived, audited query access through a browser IDE. No shared credentials; policy can block restricted tables and mask PII columns by role, before the query runs.
  • VM — keyless, recorded SSH through the cdx CLI. No bastion, no host agent, no long-lived keys; full session replay for forensics.
  • Kubernetes — ephemeral kubeconfig bound to a namespace, role, and timer — including fully private EKS / GKE / AKS clusters. No standing cluster-admin.
  • SaaS — time-boxed entitlements (GitHub, Workday, and more) granted through your IdP with automatic off-boarding when the window closes.
  • Agentic / machine identities — CI pipelines, pods, and services get short-lived scoped credentials per job instead of static keys. Every agent is registered with an owner, a use case, and a hard max session duration.
  • AI coding agents — MCP-based agents get the task, not the keys: each privileged action is approval-gated, time-bound, and stamped to the human who authorized it.

One console, one policy model, one audit trail across all seven. Approvals happen in Slack, Teams, or the console; every request, approval, session, and revocation is identity-stamped — and session recordings and audit logs are written to your own cloud storage, never ours.

Detailed setup documentation is coming soon. Contact us to see JIT on your own stack.