Personal AWS access
This guide is for administrators who decide whether to turn personal AWS access on, and for the people who use it. It is part of the Team plan and above.
What it is
Normally FunctionPilot reaches your functions through connections (roles the stack assumes in each account) and decides what each person may do with grants. With personal AWS access, people instead work with their own AWS permissions, the same ones they have in the AWS console or CLI:
- through IAM Identity Center: their accounts and permission sets, after they approve FunctionPilot in the AWS access portal; or
- with access keys: their own IAM user's keys, which FunctionPilot exchanges for temporary credentials.
Then AWS alone decides what they can do. FunctionPilot neither widens nor narrows it: no grants and no session policy apply, and CloudTrail records the person's own AWS identity. Nothing has to be deployed in the member accounts; the permission sets or IAM policies you already have decide.
| Grants on connections | Personal AWS access | |
|---|---|---|
| Who decides | FunctionPilot administrators, within each connection's access level | Your AWS permissions (permission sets or IAM policies) |
| What has to exist in each account | A spoke role | Nothing new |
| Accounts a person sees | The connections their grants name | The accounts and permission sets they choose |
| CloudTrail shows | The connection's role, with the person's email as source identity | The permission set's role session, or the IAM user |
| Best for | Tight, function-level access for teams | Engineers who already have AWS access and want a better console |
Who uses what
| The person | Works with |
|---|---|
| Has connected personal access (Identity Center or access keys) | Only their personal connections. Grants are ignored while the session lasts |
| Signs in to FunctionPilot through IAM Identity Center while Identity Center personal access is on | Personal connections only: they must connect their Identity Center session before they see any function. Grants never apply to them |
| Anyone else (Cognito users, other SAML or OIDC IdPs) | Grants on the stack's connections, as usual. They may connect access keys if that method is on |
The FunctionPilot Administrator role still governs the Administration pages for everyone. It gives no extra function access to someone working with their own AWS permissions.
Turn it on (administrators)
Set the stack parameters when you install, or later in Administration › Settings › Personal AWS access (the settings take over from the parameters once saved):
| Setting | Stack parameter | Meaning |
|---|---|---|
| IAM Identity Center | IdentityCenterStartUrl, IdentityCenterRegion | Your AWS access portal URL (https://<id>.awsapps.com/start) and the Region of your Identity Center instance |
| Access keys | PersonalAccessKeys (Enabled or Disabled, default Disabled) | Let people connect an IAM user's access keys |
| Regions for personal connections | The Regions FunctionPilot shows for every personal connection. By default, the local connection's Regions |
People's permission sets or IAM policies need the AWS permissions for what they want to do in FunctionPilot, for example:
| To | AWS actions |
|---|---|
| See functions, configuration and charts | lambda:ListFunctions, lambda:Get*, lambda:List*, cloudwatch:GetMetricData |
| Read logs and run Logs Insights | logs:FilterLogEvents, logs:DescribeLogStreams, logs:StartQuery, logs:GetQueryResults, logs:StopQuery |
| Run test events | lambda:InvokeFunction |
| Change configuration, versions, aliases and concurrency | lambda:UpdateFunctionConfiguration, lambda:PublishVersion, lambda:CreateAlias, lambda:UpdateAlias, lambda:DeleteAlias, lambda:PutFunctionConcurrency, lambda:DeleteFunctionConcurrency |
A refused call shows "Your AWS permissions don't allow this" with the AWS error code.
Connect with IAM Identity Center (users)
FunctionPilot uses the same device sign-in as aws sso login --use-device-code. You approve it in
your AWS access portal; FunctionPilot never sees your Identity Center password.
- Choose Your AWS access in the top bar (or Connect with IAM Identity Center on the Functions page if you must connect first).
- Choose Connect with IAM Identity Center. FunctionPilot shows a code.
- Choose Open the AWS sign-in page. It opens your AWS access portal in a new tab; sign in if it asks.
- Check that the page shows the same code, then allow access. FunctionPilot checks every few seconds and continues on its own; the code expires after a few minutes (Try again starts over).
- Choose the accounts and permission sets to work with (up to 20; search to find them) and Save accounts. Each one appears in the Functions table as an account, with a Your AWS access badge.
Only approve a code that you started yourself in FunctionPilot. If a page you didn't open asks you to approve a code, cancel it.
Connect with access keys (users)
- On Your AWS access, under Access keys, enter your Access key ID and Secret access key.
- If your IAM policies require MFA, enter your MFA device ARN and a current MFA code.
- Choose the Session length (1 to 12 hours, 12 by default) and Connect with access keys.
FunctionPilot exchanges the keys for temporary credentials with sts:GetSessionToken and keeps only
those temporary credentials. The secret access key is used once and never stored or logged, and
the form is cleared. Root user keys are refused: use an IAM user. Your IAM user appears as one account
in the Functions table.
Sessions
Current session on the Your AWS access page shows how you are connected, who you are signed in as, when the session ends, and your connections. Only one personal session exists at a time: connecting one kind replaces the other.
| Method | Lasts |
|---|---|
| IAM Identity Center | As long as the Identity Center access token, up to 8 hours. FunctionPilot gets one-hour role credentials from it and renews them as needed |
| Access keys | The session length you chose, 1 to 12 hours |
When the session ends, pages say Your AWS session has ended. Connect again. Choose Disconnect at any time: FunctionPilot forgets your temporary AWS credentials at once, and you stay signed in to FunctionPilot. Disconnecting works even if an administrator has since turned personal access off.
How data is shared
FunctionPilot caches function lists, metrics and Logs Insights results, and stores saved tests and their runs, per connection. A personal connection is one permission set in one account, or one IAM user. So:
- People who use the same permission set in the same account share the cached function lists and metrics (the first person's load serves the others) and see each other's public saved tests, as they would on a shared connection. Private tests stay private.
- A different permission set, a different account or a different IAM user never sees them.
ABAC caveat. If a permission set gives each person different access through session tags (attribute-based access control), its users would still share cached function lists and metrics. For such setups, use connections and grants instead of personal access.
Security
- Identity Center access tokens and temporary credentials are encrypted with a KMS key in your account, under an encryption context that names the user, so one user's item can't be decrypted as another's. Only FunctionPilot's API role may use the key, and only with that context.
- Everything is deleted when the person disconnects or the credentials expire.
- Every connect, change of accounts and disconnect is in the audit log (
personal.connect,personal.roles,personal.disconnect), with the method and principal, never tokens or keys. - CloudTrail shows the user. Calls are made with the person's own credentials: CloudTrail records the Identity Center permission set's role session, or the IAM user, in each account.
Something unclear or missing? Email [email protected].