Solution · Identity and access

Reach your clouds and servers with no stored keys.

Engineers and pipelines get cloud roles and server sessions on credentials that last minutes, instead of keys that sit in files for years.

Cloud roles, with no stored keys

AuthFI decides who is granted a role. The cloud decides, when the role is assumed, whether to honour it. This page shows where the two disagree.

What changes

The problem as most companies have it today, and the same thing with AuthFI.

Today: Cloud access keys live in laptops and pipelines

With AuthFI: Roles are assumed with a short-lived token, and no key is stored

Today: SSH keys are copied to servers and never removed

With AuthFI: A server certificate that lasts five minutes

Today: Leavers keep access until someone remembers

With AuthFI: Remove them from the group and the access is gone

Today: Nobody can say who ran what as root

With AuthFI: Sessions and privileged commands are on the record

Each step, on the screen you would use.

Cloud

Connect an AWS or Google Cloud account. AuthFI finds its roles, and you grant them to groups.

AWS and Google Cloud

No access key is created or stored

A grant follows the group

Servers

People sign in to a server with a certificate issued for that session. There is no key to leak and none to revoke.

Certificates that last five minutes

Access by group

Every session recorded as an event

Keyless roles on

AWSGoogle Cloud

Cloud roles are available for AWS and Google Cloud. Rules for privileged commands are in pilot.

Apps and cloud access

Clouds, servers and connections

Keys and secrets

Signing keys and sealed secrets

Security and audit

The record of who did what