Approval workflow integration

Platform operators integrate Boundary with an external approval workflow platform to enable just-in-time (JIT), time-bound access. This is typically driven by updating IdP-managed groups on approval and expiry.

Integration with approval workflow platforms

• PagerDuty: Integrating with PagerDuty allows for automated incident response workflows. When an incident occurs, necessary personnel can request and receive access to critical systems immediately, ensuring a quick and efficient resolution.

• ServiceNow: Service Now is widely used for IT service management. Integrating JIT workflows with ServiceNow allows for access requests to be part of existing ITSM processes, enhancing visibility and control.

• Slack: Slack integration allows for real-time communication and approval. Teams can manage and approve access requests directly within their Slack channels, leveraging the collaboration platform for immediate action.

How just-in-time approval works with Boundary

The diagram above outlines the high level process of how just-in-time (JIT) approval works with Boundary.

1. Request access submission
   • The user submits a request to access target resources through approval workflow platforms such as ServiceNow, PagerDuty, Slack, etc
   • The request will include the context such as the purpose of the request, the required access time window, and the target resource.
2. Manager approval
   • The manager reviews the change request and makes the decision to either approve or deny the access request.
3. Approval workflow execution (upon approval)
   • Upon approval of the request, the workflow process is executed.
   • E.g: The workflow will update to IdP managed groups (which is our recommended approach) to grant access to the user.
4. Access granted and time-bounded
   • The user is added to the appropriate group within HashiCorp Boundary for a specific time period, and access is granted to the target resource in the specified project. The access granted to the user is time-bounded and will expire after a predefined number of hours.
5. Approval workflow execution (upon expiry)
   • Once the time period expires, the approval workflow is executed again. The flow updates the HashiCorp Boundary configuration to remove the user from the group.
6. Access removal
   • The user’s access to the target resource is revoked. And the user is removed from the specific group in the HashiCorp Boundary.
7. Close the change
   • The change request is closed in the approval workflow platform, completing the workflow process.