Show HN: Sym, define just-in-time access workflows in code

My cofounder (jon918) and I started Sym three years ago because we were frustrated with how hard it was to manage access to cloud infrastructure. We wanted to build a tool for JIT access that was actually designed for developers. We were wary of tools that tried to accommodate both devs and IT but ended up with usability compromises for both.

First, we figured no one wants another web app to log into so we let administrators define access workflows in Terraform and let developers request and gain access via Slack. That seemed to pay off: being code-based was a big plus for our early customers since it let them manage the logic in version control and test in CI/CD.

Second, we knew that updating permissions/roles/access was a major source of toil and risk in the world of cloud infrastructure. Have you ever tried to avoid annoying, persistent access requests by setting policies that are a bit more permissive than you’d like? We felt that fully automated just-in-time access + approvals could really help here. But we also knew that a simple approval tool could end up leading to request fatigue - kind of defeating the purpose. So we built an SDK to let you define checks in code (e.g. pagerduty.on_call, okta.is_user_in_group, github.get_repo_collaborators) in order to dynamically route requests or fast-track access when appropriate. This seems to be paying off: users are creating Slack-based approvals in front of different types of risky actions like production access, sensitive queries and triggering Lambdas.

We’d love your feedback on our approach so far. Does this make sense to you? Is this a tool you'd use? What would you want to see out of it?

To learn more, check out the video that Nick (nmeans (Sym VPEng)) made [1]. You can also check out our docs [2] or set up your own flow [3].

thanks!

-adam

[1] https://vimeo.com/815222490/c717c18c42

[2] https://docs.symops.com

[3] https://symops.com/signup

Show HN: Sym, define just-in-time access workflows in code
symops.com

Really feels like security can actually be "everyone's job" when you're able to make good access management decisions from within your existing tools and their supporting context.

My thoughts is that once you have all IaC set up hopefully this becomes less of a problem since you do things through PRs not clickops, and we might be setting up the roles via pulimi (or terraform) anyway.

I guess the value here is in the exceptions, where you quickly want to give a human access to an area to dive in and solve a production issue?