Docs · Reference

Questions and answers

Short answers to the questions people ask before and after connecting, each with its own link.

Each question is a link. Send someone the exact answer.

Does CloudGrant have admin access to my AWS? #

No. The connect stack creates a read-only role, a role that can only create and delete permission-set assignments, and an optional role for editing permission sets and Identity Center users from the console. None of them can touch IAM users or policies outside Identity Center's own, read your data, or change CloudFormation. The full permission lists are on what CloudGrant can do in your AWS.

What happens when access expires? #

CloudGrant removes the assignment itself, server-side, at the end of the window. A per-grant timer fires at the exact minute, and a sweep every five minutes is the backstop if a timer is ever missed. The person is told their access ended.

By default the approver also leaves "Automatically block further use" on, when the permission set's session can outlast the grant (web Approvals only - Slack has no checkbox, so a Slack approve does not set this). That writes a deny onto the permission set, conditioned on when the session was issued, then pushes it into the account. Their next action in AWS is refused. A call already in flight is not cancelled. The push takes a few seconds. The approver can uncheck that box, or later use "Stop new sign-ins", if they only want the assignment gone. Auto-approve, on-call and break-glass never set it. "Lock them out now" on Live access is the same deny, on demand - including for access handed out as keys rather than Identity Center.

Can someone approve their own request? #

No. A requester can never approve their own request, and someone who opened a request on another person's behalf cannot approve that one either. A rule can require more than one approver.

Where is my data stored? #

In AWS eu-central-1 (Frankfurt), in a single region, run by a Swiss company. Nothing is replicated outside the EU. That is EU residency, not a claim that US cloud law cannot reach AWS. The privacy policy and the DPA summary have the details.

Can I try it without connecting AWS? #

Yes. A new workspace offers a sample company on Get started: made-up accounts, people, rules and history, with one request waiting for your approval. Nothing in it touches AWS, and it goes away the moment you connect your own. See try it on a sample company.

What does the audit log record, and can I export it? #

Every request, approval, denial, grant, expiry, revoke and break-glass use, stamped with the person who did it, plus rule changes, connections and member changes. Download it as CSV on every package. The signed evidence pack is included from the Organization package up, and during the trial. CloudGrant holds the signing key: the signature proves the file was not edited after export, not that a third party could reconstruct the trail without trusting us. Exports are off while the sample company is loaded, because nothing in it is real.

What is a rule? #

A rule says who can request what, for how long, and whether it needs approval. Rules match people by workspace group, by Identity Center group, or by name; they match access by account, organizational unit and permission set or IAM role. Where no rule points, nothing can be requested. There is no other switch.

How do I disconnect, or leave entirely? #

End live access, disconnect on the Connect AWS page, delete the stacks in your AWS, and delete the workspace from your Account page. The order matters and the console enforces the parts it can. See leaving CloudGrant.

How is a workspace named, and can I rename it? #

At first sign-in the workspace is named after your email domain. An owner can rename it on the Account page.

Does CloudGrant work without Identity Center? #

Yes. A rule can point at an IAM role in an account instead, deployed from the direct-access template. People then receive temporary keys from CloudGrant rather than signing in through the access portal, and "lock them out now" works through the session manager role in that stack.