awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

documentation revamp

Browse Source
This commit is contained in:
Vladyslav Matsiiako
2024-03-31 23:37:57 -07:00
parent 4323407da7
commit f623c8159d
93 changed files with 767 additions and 384 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/documentation/platform/access-controls/access-requests.mdx Normal file
View File

@@ -0,0 +1,13 @@
---
title: "Access Requests"
description: "Learn how to request access to sensitive resources in Infisical."
---
In certain situations, developers need to expand their access to certain new project or a sensitive environment. For those use cases, it is helpful to utilize Infisical's **Access Requests** functionality.
This functionality works in the following way:
1. A project administrator sets up a policy that assigns access managers to a certain sensitive folder or environment.
2. When a developer requests access to one of such sensitive resources, corresponding access managers get an email notification about it.
3. An access manager can approve or deny the access request as well as specify the duration of access in the case of approval.
4. As soon as the request is approved, developer is able to access the sought resources.

22
docs/documentation/platform/access-controls/additional-privileges.mdx Normal file
View File

@@ -0,0 +1,22 @@
---
title: "Additional Privileges"
description: "Learn how to add specific privileges on top of predefined roles."
---
Even though Infisical supports full-fledged [role-base access controls](./role-based-access-controls) with ability to set predefined permissions for user and machine identities, it is sometimes desired to set additional privileges for specific user or machine identities on top of their roles.
Infisical **Additional Privileges** functionality enables specific permissions with access to sensitive secrets/folders by identities within certain projects. It is possible to set up additional privileges through Web UI or API.
To provision specific privileges through Web UI:
1. Click on the `Edit` button next to the set of roles for user or identities.
![Edit User Role](../../images/platform/access-controls/edit-role.png)
2. Click `Add Additional Privileges` in the corresponding section of the permission management modal.
![Add Specific Privilege](../../images/platform/access-controls/add-additional-privileges.png)
3. Fill out the necessary parameters in the privilege entry that appears. It is possible to specify the `Environment` and `Secret Path` to which you want to enable access.
It is also possible to define the range of permissions (`View`, `Create`, `Modify`, `Delete`) as well as how long the access should last (e.g., permanent or timed).
![Additional privileges](../../images/platform/access-controls/additional-privileges.png)
4. Click the `Save` button to enable the additional privilege.
![Confirm Specific Privilege](../../images/platform/access-controls/confirm-additional-privileges.png)

58
docs/documentation/platform/access-controls/overview.mdx Normal file
View File

@@ -0,0 +1,58 @@
---
title: "Access Controls"
sidebarTitle: "Overview"
description: "Learn about Infisical's access control toolset."
---
To make sure that users and machine identities are only accessing the resources and performing actions they are authorized to, Infisical supports a wide range of access control tools.
<CardGroup cols={2}>
<Card
title="Role-based Access Controls"
href="./role-based-access-controls"
icon="address-book"
color="#000000"
>
Manage user and machine identitity permissions through predefined roles.
</Card>
<Card
title="Additional Privileges"
href="./additional-privileges"
icon="ballot-check"
color="#000000"
>
Add specific privileges to users and machines on top of their roles.
</Card>
<Card
title="Temporary Access"
href="./temporary-access"
icon="clock"
color="#000000"
>
Grant timed access to roles and specific privileges.
</Card>
<Card
title="Access Requests"
href="./access-requests"
icon="check"
color="#000000"
>
Enable users to request (temporary) access to sensitive resources.
</Card>
<Card
title="Approval Workflows"
href="/documentation/platform/pr-workflows"
icon="thumbs-up"
color="#000000"
>
Set up review policies for secret changes in sensitive environments.
</Card>
<Card
title="Audit Logs"
href="/documentation/platform/audit-logs"
icon="list"
color="#000000"
>
Track every action performed by user and machine identities in Infisical.
</Card>
</CardGroup>

44
docs/documentation/platform/access-controls/role-based-access-controls.mdx Normal file
View File

@@ -0,0 +1,44 @@
---
title: "Role-based Access Controls"
description: "Learn how to use RBAC to manage user permissions."
---
Infisical's Role-based Access Controls (RBAC) enable the usage of predefined and custom roles that imply a set of permissions for user and machine identities. Such roles male it possible to restrict access to resources and the range of actions that can be performed.
In general, access controls can be split up across [projects](/documentation/platform/project) and [organizations](/documentation/platform/organization).
## Organization-level access controls
By default, every user and machine identity in a organization is either an **admin** or a **member**.
**Admins** are able to perform every action with the organization, including adding and removing organization members, managing access controls, setting up security settings, and creating new projects.
**Members**, on the other hand, are restricted from removing organization members, modifying billing information, updating access controls, and performing a number of other actions.
Overall, organization-level access controls are significantly of administrative nature. Access to projects, secrets and other sensitive data is specified on the project level.
![Org member role](../../images/platform/rbac/org-member-role.png)
## Project-level access controls
By default, every user in a project is either a **viewer**, **developer**, or an **admin**. Each of these roles comes with a varying access to different features and resources inside projects.
As such:
- **Admin**: This role enables identities to have access to all environments, folders, secrets, and actions within the project.
- **Developers**: This role restricts identities from performing project control actions, updating Approval Workflow policies, managing roles/members, and more.
- **Viewer**: The most limiting bulit-in role on the project level – it forbids user and machine identities to perform any action and rather shows them in the read-only mode.
![Project member role](../../images/platform/access-controls/rbac.png)
## Creating custom roles
By creating custom roles, you are able to adjust permissions to the needs of your organization. This can be useful for:
- Creating superadmin roles, roles specific to SRE engineers, etc.
- Restricting access of users to specific secrets, folders, and environments.
- Embedding these specific roles into [Approval Workflow policies](/documentation/platform/pr-workflows).
<Note>
It is worth noting that users are able to assume multiple built-in and custom roles. A user will gain access to all actions within the roles assigned to them, not just the actions those roles share in common.
</Note>
![project member custom role](../../images/platform/rbac/project-member-custom-role.png)

26
docs/documentation/platform/access-controls/temporary-access.mdx Normal file
View File

@@ -0,0 +1,26 @@
---
title: "Temporary Access"
description: "Learn how to set up timed access to sensitive resources for user and machine identities."
---
Certain environments and secrets are so sensitive that it is recommended to not give any user permanent access to those. For such use cases, Infisical supports the functionality of **Temporary Access** provisioning.
To provision temporary access through Web UI:
1. Click on the `Edit` button next to the set of roles for user or identities.
![Edit User Role](../../images/platform/access-controls/edit-role.png)
2. Click `Permanent` next to the role or specific privilege that you want to make temporary.
3. Specify the duration of remporary access (e.g., `1m`, `2h`, `3d`).
![Configure temp access](../../images/platform/access-controls/configure-temporary-access.png)
4. Click `Grant`.
5. Click the corresponding `Save` button to enable remporary access.
![Temporary Access](../../images/platform/access-controls/temporary-access.png)
<Note>
Every user and machine identity should always have at least one permanent role attached to it.
</Note>