This is the access and trust mechanism underneath Managed DevOps & Cloud Ops and every audit engagement that touches live infrastructure: granted securely, with a full audit trail, on your terms, and revocable in one command. No shared credentials ever cross the wire, built and open-sourced as grant-access.
Our engineers authenticate to continuous.engineering's own identity provider with MFA enforced, every session. That identity assumes a role inside your account through a stack you deploy and own: a CloudFormation template on AWS, a native gcloud script on GCP, a native az script on Azure. Sessions are short-lived (AWS/GCP: 2-4 hours) or individually revocable (Azure). Every action lands in your own cloud's audit log under the individual engineer's identity, not a shared one.
Instance access never requires an open port: AWS Systems Manager Session Manager, GCP Identity-Aware Proxy tunneling, Azure Bastion with Entra ID. Port 22 stays closed. Your security groups don't change.
Read-only work gets a read-only role. Infrastructure work gets a DevOps-scoped role. Database shell access can be restricted to instances you've tagged. Production can be denied entirely. You grant exactly what the engagement needs.
The admin role is the shortest-lived, most tightly scoped role of all. On AWS, your security team is emailed every single time it's assumed, within seconds, not discovered later in a log review.
Delete the CloudFormation stack (AWS), run the removal flag on the deploy script (GCP/Azure), and every CE role or binding is removed immediately. There are no credentials to hunt down, because our engineers never held any of yours.
Shared IAM users with access keys. No expiry by default, no MFA on API calls, no way to know which engineer used the key, and rotation that rarely happens because nobody owns it.
VPN + SSH. Accounts outlive engagements, keys proliferate across servers, port 22 has to stay open, and there's no audit trail of what commands actually ran.
Shared root or admin passwords. No comment needed.
Logical access controls, system monitoring, and vendor risk mitigation: least-privilege roles, no standing credentials, per-engineer audit trail, one-command revocation.
Unique user identification, automatic logoff via session expiry, audit controls, and person/entity authentication enforced by MFA before any session exists.
Deny-by-default access control, unique IDs with strong authentication, and immutable audit logging your cloud provider writes and protects, not us.
Full control-by-control mapping, evidence package guidance, and BAA process: Compliance reference ↗
Step-by-step for AWS, GCP, and Azure: the exact CloudFormation template, gcloud script, or az script to run, and what it creates in your account.
→Identity (our side, MFA-enforced) and confused-deputy protection (your side, ExternalId / provider binding / named guest invite), explained per cloud.
→Read-only through admin, per cloud, with the specific permissions each tier carries and how session length differs between AWS/GCP and Azure.
→A dedicated CloudWatch log group and dashboard covering role usage, trends, source IPs, instances accessed, and anomaly detection. No setup required.
→The short version built to get internal sign-off before you deploy anything.
→How our own engineers are controlled: MFA enforcement evidence, tiered access groups, data handling, and incident response, per cloud.
→Maya can walk through which role fits your engagement, or how session length differs across clouds. For anything your audit team needs in writing, reach devops@continuous.engineering.