Here's our product and community news for April.

Community Newsletter: April 2023

<h1>Community Newsletter: April 2023</h1>
<p>Hey everyone! Chris here with a monthly update for you. If you want to contribute to what we're building, or would like more regular weekly updates, please join our <a href="https://join.slack.com/t/commonfatecommunity/shared_invite/zt-q4m96ypu-_gYlRWD3k5rIsaSsqP7QMg">Slack community</a> or follow us on <a href="https://twitter.com/CommonFateTech">Twitter</a>.</p>
<p>Here's what's been happening in the world of Common Fate over the past month:</p>
<h2>Provider Registry</h2>
<p>We've released the Provider Registry - a central repository that serves as a public database for storing and sharing Access Providers. The Provider Registry allows developers to discover, publish, and deploy Access Providers built by the Common Fate community.</p>
<p><a href="https://www.commonfate.io/blog/provider-registry">Read our announcement</a> or visit the registry at <a href="https://registry.commonfate.io">registry.commonfate.io</a>.</p>
<p><img src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/8b72a880-8862-d14c-d970-9f79f1df253f.png" alt=""></p>
<h3>Common Fate featured at AWS Community Day Nordics</h3>
<p><a href="https://www.linkedin.com/in/tmylo/">Theodoros Mylonidis</a>, a CloudOps Engineer at <a href="https://en.qred.se/">Qred</a>, gave a presentation at AWS Community Day Nordics this month on how Qred uses Common Fate to manage privileged access to their AWS organisation. Theo has led the deployment of Common Fate at Qred and is an advocate for developer-friendly privileged access workflows.<br>
</p>
<p><img src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/f183dbd7-c0e4-7f32-54d6-866ad2a22bfc.jpeg" alt=""></p>
<p><img src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/7c83fd87-f3ea-14b3-1a6f-3b6573c04c26.jpeg" alt=""></p>
<h2>Granted user experience improvements</h2>
<p><a href="https://granted.dev/">Granted</a> uses the system keychain to securely store cloud credentials. This month, we released improvements to our keychain integration which make Granted a lot faster to use with tools like <a href="https://kubernetes.io/docs/reference/kubectl/">kubectl</a>:</p>
<ul>
<li><a href="https://github.com/common-fate/granted/pull/396">Improved caching of AWS credentials</a> (released in <a href="https://github.com/common-fate/granted/releases/tag/v0.10.0">v0.10</a>)</li>
<li><a href="https://github.com/common-fate/granted/pull/404">Improved MacOS keychain UX</a> (released in <a href="https://github.com/common-fate/granted/releases/tag/v0.11.0">v0.11</a>)</li>
</ul>
<p>A big thankyou to <a href="https://github.com/lyoung-confluent">Luke Young (@lyoung-confluent)</a> for contributing these improvements.<br>
</p>
<h2>Granted CLI Access Requests</h2>
<p>In <a href="https://github.com/common-fate/granted/releases/tag/v0.11.0">Granted v0.11</a>, team members using the AWS CLI can now request access to AWS roles using Common Fate directly from the terminal. <a href="https://docs.commonfate.io/granted/recipes/access-requests">Read about this in our documentation here.</a></p>
<p><img src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/f1c10683-feb5-8ca3-6e4b-b0f41e26a973.gif" alt=""></p>
<h2>Upcoming Events</h2>
<p>We have some exciting events coming up in the near future! Mark your calendars for:</p>
<ul>
<li><a href="https://aws.amazon.com/events/summits/london/">AWS London Summit</a>, 7 June 2023
<ul>
<li>Chris (myself! Co-founder and CTO) will be there in person</li>
</ul>
</li>
</ul>
<h2>Feedback</h2>
<p>As always, we want to hear from you! If you have any feedback, suggestions, or ideas for how we can make Granted and Common Fate even better, please don't hesitate to reach out.</p>
<p>Until next time,</p>
<p>The Common Fate Team</p>


# Community Newsletter: April 2024

Hey everyone! Shwetha here with the latest tech update. If you're eager for deeper insights and real-time updates, make sure to join our [Slack community](https://join.slack.com/t/commonfatecommunity/shared_invite/zt-q4m96ypu-_gYlRWD3k5rIsaSsqP7QMg) or follow us on [Twitter](https://twitter.com/CommonFateTech).

Here's what's been happening in the world of Common Fate over the past month:

## **Preview Access**

![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/e86d1613-e117-2559-d168-89693916a4d5.png)

Preview the access granted to each Common Fate user as per your authorization policies. By default, users in Common Fate lack permission to view authorization logs. Refer to [our documentation](https://docs.commonfate.io/observability/preview-access) to learn how to configure this.

## **BigQuery Access**

<img
  src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/c50b22fa-ff3f-7f1c-f86f-000842e9fa47.png"
  style={{
    clipPath: "inset(5px 5px 5px 5px)",
  }}
/>

Common Fate now [integrates with BigQuery](https://docs.commonfate.io/integrations/bigquery) to provision Just-In-Time access to data. The integration creates an inventory of BigQuery resources across a Google Cloud organization and allows access to be requested to individual Tables or Datasets.

## Webhook Integrations

![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/760c9683-08bf-24b9-7b88-7a09a319cded.png)

Connect Common Fate to other security tools or build custom integrations using our [new webhook integration](https://docs.commonfate.io/integrations/webhook). Using webhooks you can stream audit log or authorization events to any HTTP endpoint.

## Granted Updates

In our ongoing commitment to enhancing Granted, we're excited to share the latest updates:

**Just-In-Time (JIT) access using Common Fate + Granted**

Granted can now be used with **[Common Fate](https://docs.commonfate.io/introduction)** for just-in-time access to privileged AWS roles. For more information on JIT access, check out the [JIT recipe](https://docs.commonfate.io/granted/recipes/access-requests) in our documentation.

A big shoutout to our first-time contributors:

- [@Nepoxx](https://github.com/Nepoxx) made their first contribution in [#631](https://github.com/common-fate/granted/pull/631)
- [@gautamg795](https://github.com/gautamg795) made their first contribution in [#635](https://github.com/common-fate/granted/pull/635)
- [@treuherz](https://github.com/treuherz) made their first contribution in [#636](https://github.com/common-fate/granted/pull/636)

For a comprehensive list of changes, please visit our [changelog](https://github.com/common-fate/granted/releases).

Your voice shapes our tools. We value your feedback, suggestions, and ideas, so please don't hesitate to get in touch.

Until next time,

The Common Fate Team


Community Newsletter: April 2024


# Common Fate Product Updates

Today we’re releasing new integrations for Common Fate, as well as an improved support experience for your end users using our access platform.

## BigQuery Access Integration

Common Fate now integrates with BigQuery to provision Just-In-Time access to data. The integration creates an inventory of BigQuery resources across a Google Cloud organization and allows access to be requested to individual Tables or Datasets.

[Read our integration guide here.](https://docs.commonfate.io/integrations/bigquery)

<img
  src="/blog_posts/bigquery.png"
  style={{
    clipPath: "inset(5px 5px 5px 5px)",
  }}
/>

## GCP Organization-Level Access

We’ve added support for provisioning Just-In-Time access at the organization level.

[Read our integration guide here.](https://docs.commonfate.io/integrations/gcp#organization-level-access)

## Embedded Product Support

You can now reach out to Common Fate support directly within the web console for assistance and feedback.

<img
  src="/blog_posts/embedded_product_support.png"
  style={{
    clipPath: "inset(5px 5px 5px 5px)",
  }}
/>

## **Webhook Integrations**

Connect Common Fate to other security tools or build custom integrations using our new webhook integration. Using webhooks you can stream audit log or authorization events to any HTTP endpoint. Get started: [Webhook Integration Guide](https://docs.commonfate.io/integrations/webhook).

![](/blog_posts/webhook.png)

## CLI improvements

The [Common Fate CLI](https://github.com/common-fate/cli) now automatically populates your local AWS configuration file when access is provisioned.

![](/blog_posts/cli_improvements.png)


Here's our most recent product update

Common Fate Product Updates


At Common Fate we're big fans of [authorization-as-code](https://docs.commonfate.io/authz/introduction). Treating your authorization policies as source code means you can test and review changes using your existing tools like Terraform and GitHub. We use [Cedar](http://www.cedarpolicy.com) as the authorization-as-code framework in [our product](https://docs.commonfate.io/introduction).

Here's an example Cedar policy you might write:

```cedar
@advice("You can request access because you're currently on-call.")
permit (
  principal in PagerDuty::OnCall::"PDXYZ123",
  action == Access::Action::"Request",
  resource is AWS::IDC::AccountEntitlement
)
when
{
    resource.role == AWS::IDC::PermissionSet::"arn:aws:sso:::permissionSet/ssoins-12345abcdef/ps-12345abcdef" &&
    resource.target in AWS::OrgUnit::"ou-123abc" &&
    resource.target.tags.contains({key: "department", value: "engineering"})
};
```

As you can see above, Cedar is **suuper** flexible. We can slice and dice authorization based on the AWS account tags, our AWS organization hierarchy, and our users' on-call status in PagerDuty. Pretty neat!

What's _not_ neat though is making typos in policies. If I fat-finger my policy code and write `Access::Action::"Reqeust"` instead of `Access::Action::"Request"`, Cedar won't match the action and I'll see an Access Denied.

<figure>
  <img
    src="/blog_posts/validating-cedar-with-github-actions/authorization-log.png"
    alt="Screenshot of authorization logs inside Common Fate showing many 'Access Denied' events"
  ></img>
  <figcaption>
  This is what our <a href="https://docs.commonfate.io/observability/authorization">
  authorization log</a> looks like when you fat-finger a policy.
  </figcaption>
</figure>

Fortunately, Cedar has some great tooling to validate your policies before they are deployed. We'll run through some of this tooling below, including a ✨ brand new ✨ [GitHub Action we've just released](https://github.com/marketplace/actions/validate-cedar-policies) to validate policies automatically.

## Validating locally

Cedar has support for type definitions similar to programming languages like [TypeScript](https://www.typescriptlang.org/). In Cedar, you use a [schema file](https://docs.cedarpolicy.com/schema/schema.html) to define the principals, actions, and resources used for authorization.

Writing a schema is straightforward, but because we want to get stuck into validation you can use one we've prepared earlier. [Create a new GitHub respository based on our Cedar template repository here](https://github.com/new?template_name=cedar-github-actions-testing-example&template_owner=common-fate). Once you've created it, clone the repository to your local machine.

The repository contains a demo policy, allowing everyone to view `Document` resources:

```cedar
permit (
    principal,
    action == Action::"View",
    resource is Document
);
```

To get set up for local policy validation we'll [install Rust](https://www.rust-lang.org/tools/install), then install the Cedar CLI:

```bash
cargo install cedar-policy-cli
```

Then, we can validate policies by running `cedar validate`:

```
❯ cedar validate --schema test.cedarschema.json --policies demo.cedar
  ☞ policy set validation passed
  ╰─▶ no errors or warnings
```

It's passing!

This is great, but it would be even better if we could have GitHub Actions run policy validations automatically when we make changes.

## Validating in GitHub Actions

Today we're releasing a [GitHub Action](https://github.com/marketplace/actions/validate-cedar-policies) allowing you to check for invalid policies as part of your Continuous Integration (CI) pipelines. Our GitHub Action adds annotations to your Pull Requests showing precisely where issues are.

![Screenshot of GitHub annotations created by the Cedar Validate action](/blog_posts/validating-cedar-with-github-actions/annotation-screenshot.png)

You can add the action to your GitHub Actions workflows by adding a `.github/workflows/cedar.yml` file containing the following:

```yaml
name: "Test"

on: [push]

jobs:
  cedar:
    name: Cedar
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate Policies
        uses: common-fate/cedar-validate-action@v1
        with:
          schema-file: ./example.cedarschema.json
          policy-files: "**/*.cedar"
```

## Policy validation in Common Fate

If you'd like to learn more about validating policies in Common Fate, you can read our [guide on developing authorization policies with continuous integration (CI)](https://docs.commonfate.io/authz/ci).

## What's next

We're planning on introducing additional tooling to help unit test Cedar policies using GitHub Actions. If you're interested in discussing this we'd love to hear from you in our [Slack community](https://join.slack.com/t/commonfatecommunity/shared_invite/zt-q4m96ypu-_gYlRWD3k5rIsaSsqP7QMg) - or you can follow us on [X](https://twitter.com/CommonFateTech) to stay updated.


A guide on how to validate Cedar authorization policies using GitHub Actions.

Validating Cedar policies with GitHub Actions


# Community Newsletter: March 2024

Hey everyone! Shwetha here with the latest tech update. If you're eager for deeper insights and real-time updates, make sure to join our [Slack community](https://join.slack.com/t/commonfatecommunity/shared_invite/zt-q4m96ypu-_gYlRWD3k5rIsaSsqP7QMg) or follow us on [Twitter](https://twitter.com/CommonFateTech).

Here's what's been happening in the world of Common Fate over the past month:

## DataStax Integration

We've introduced a built-in [DataStax](https://www.datastax.com/) Integration for seamless, just-in-time access to roles within DataStax. Learn more about the setup and process [here](https://docs.commonfate.io/integrations/datastax). Want to see this in action? Book a live demo using [this link](https://savvycal.com/common-fate/d3c7f2e9).

![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/6dee01e1-9d74-0060-e64f-9947eba145f3.png)

## Authorization Logs

We have added authorization logs to inspect and debug authorization events within Common Fate. Each time an authorization decision is made, Common Fate stores a log of the evaluation. In [this guide](https://docs.commonfate.io/observability/authorization), you’ll learn how to use authorization logs to debug your authorization policies.

![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/79f55254-4a0c-f4e9-f13b-7a1a6a6f67d6.png)

## Fourtheorem Blog Post

We were recently featured on Fourtheorem’s blog post on Managing AWS accounts like a PRO, which goes through the process of setting up IAM Identity Center with Granted to obtain credentials through Granted.

[You can read the blog post here](https://fourtheorem.com/managing-aws-accounts-part-1/)

![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/21cbc61d-de82-86e0-6380-71a03eaeb007.png)

## Granted Updates

In our ongoing commitment to enhancing Granted, we're excited to share the latest updates:

**Added support for refreshable AWS SSO:**

- You can now add `granted_sso_registration_scopes = sso:account:access` to your `~/.aws/config`, which will cause Granted to respect the [session duration](https://docs.aws.amazon.com/singlesignon/latest/userguide/configure-user-session.html) in IAM Identity Center. This can be extended to prompt less frequently. Supplying the `sso:account:access` scope will cause IAM Identity Center to return a refreshable access token, with a total allowed session time in accordance with your configured AWS SSO session length.

**IAM Federated logins now have attributable username in Cloudtrail**

- The changes refactor the way federation token ID is used for AWS IAM credentials. Instead of relying on the `userID` which was previously parsed, the code now uses the `userName` which is more easily attributable to the IAM user name in the Cloudtrail events list view. Thank you to [@matthewhembree](https://github.com/matthewhembree) for their contributors on this.

A big shoutout to our first-time contributors:

- [@CodyDunlap](https://github.com/CodyDunlap) made their first contribution in [#611](https://github.com/common-fate/granted/pull/611)
- [@matthewhembree](https://github.com/matthewhembree) made their first contribution in [#626](https://github.com/common-fate/granted/pull/626)
- [@keymon](https://github.com/keymon) made their first contribution in [#619](https://github.com/common-fate/granted/pull/619)

For a comprehensive list of changes, please visit our [changelog](https://github.com/common-fate/granted/releases).

Your voice shapes our tools. We value your feedback, suggestions, and ideas, so please don't hesitate to get in touch.

Until next time,

The Common Fate Team
