Just-in-Time Access
JIT Access

Please wait

Your request is being processed...

Access granted

You've been temporarily granted the following roles:
Role ID Status Expiry

Requesting just-in-time access

This application lets you request temporary access to a Google Cloud project. To request access, you need to provide the following:

  • The project to access
  • One or more roles to activate
  • A justification that explains why you need access to this project

You can only request access to projects and roles that you've been granted eligible access to, and your access automatically expires after a certain period of time.

Grant just-in-time access

As an administrator you can grant users or groups eligible access to Google Cloud projects.

To grant eligible access, use the Cloud Console or gcloud to create an IAM role binding for a user or group, and make it eligible by adding a special IAM condition:

has({}.jitAccessConstraint)
You can create the IAM role binding for a specific project, or for an entire folder.

For example, the following gcloud grants eligible access to a user:

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member user:USER \
    --role ROLE \
    --condition "title=Eligible access,expression=has({}.jitAccessConstraint)"

Audit and review just-in-time access

As an administrator, you can use Cloud Logging to review when and why eligible roles have been activated by users.

For example, the following filter lets you find all instances when a role has been activated:

labels.event="api.activateRole"

Toast!