Privileged Policies

Table of Contents

  1. What It Does
  2. Creating a Policy
  3. One Policy per Principal and Resource
  4. Maximum Duration
  5. Requires Approval

What It Does

A Privileged Policy is the rule that says who may request what access. Each policy grants an IAM Identity Center (IDC) user or group the ability to request temporary access to one or more AWS accounts and/or Organizational Units (OUs) using a specific Permission Set.

A privileged policy never grants access on its own — it sets the boundaries of what someone is allowed to request. Actual access is always time-limited and comes through an Access Request.

Managing Privileged Policies is an admin-only capability.

Creating a Policy

When an admin creates a policy, they choose:

  • Principal — the IDC user or group the policy applies to.
  • Permission Set — the AWS permission set the principal may assume.
  • Accounts and/or OUs — where the access applies. Selecting an OU covers the accounts within it.
  • Maximum duration — the longest a request against this policy may last. Requests may ask for less, never more.
  • Requires approval — whether an approver must sign off before access is granted (see the Approval Workflow).

One Policy per Principal and Resource

Snitch allows only one policy for a given principal on a given account or OU. If you try to create a second policy that overlaps an existing one for the same user or group, Snitch blocks it and tells you which policy already covers that resource. This keeps each principal’s access to any account unambiguous.

Maximum Duration

Each policy sets a maximum access duration. In the form you pick a future date and time, and Snitch stores the resulting length. When a user requests access, their chosen duration is checked against this maximum before the request is accepted. Durations are shown throughout the app in a readable form such as 45min, 8h 30min, or 2d 8h.

Requires Approval

Turning on Requires approval for a policy means any request against it pauses for sign-off before access is granted:

  1. The Request Access form warns the user that approval is required.
  2. On submission the request waits in a Pending approval state.
  3. An authorized approver approves or rejects it (or it times out after 24 hours).

Who can approve is configured separately — see the Approval Workflow.

Snitch — Privileged Access Management

This site uses Just the Docs, a documentation theme for Jekyll.