Right now our on-call engineers have a shared read-write Postgres user for prod incidents, which is obviously not great. What we’d want instead is for someone to request access at 2am, get approval from whoever else is awake, and have the access expire on its own afterwards. Does PAM support request and approval flows like this, or is access something an admin has to grant and then remember to revoke?
Hey hey!
We do have this with PAM access requests! Someone requests access at 2am with a reason and how long they need it, and anyone in the approver group you set on that folder gets pinged by email, Slack or in the app and approves. Access expires on its own when the time is up. You can also require MFA before the session starts, and every session is recorded. LMK if you have any other questions!
Thanks,
Jake