Here's our product and community news for May.

Community Newsletter: May 2024

<h1>Community Newsletter: May 2024</h1>
<p>Hey everyone! Shwetha here with the latest tech update. If you're eager for deeper insights and real-time updates, make sure to join our <a href="https://join.slack.com/t/commonfatecommunity/shared_invite/zt-q4m96ypu-_gYlRWD3k5rIsaSsqP7QMg">Slack community</a> or follow us on <a href="https://twitter.com/CommonFateTech">Twitter</a>.</p>
<p>Here's what's been happening in the world of Common Fate over the past month:</p>
<h2><strong>GCP Role Group</strong></h2>
<p><img src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/435ad2cf-3186-6721-5eb1-8914aacec306.png" alt=""></p>
<p>Common Fate now supports <a href="https://docs.commonfate.io/integrations/gcp#gcp-role-group-access">GCP Role Groups</a>. This feature allows you to streamline permissions across multiple GCP roles by defining role groups. Role groups enable you to bundle multiple predefined roles, such as folder admin and owner, into a single entity. Users can then request access to these role groups for GCP projects or folders. GCP Role Groups allow you to work around the permission count restriction in custom roles.</p>
<h2><strong>Auth0 integration</strong></h2>
<p>&#x3C;img
src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/957cc4f5-1a75-72d2-5ea2-e13acd7945b6.png"
style={{
backgroundColor: "white",
}}
/></p>
<p>Common Fate now integrates with <a href="https://auth0.com/">Auth0</a> to provision Just-In-Time access. This integration allows users to request temporary access to Auth0 Organizations.</p>
<h2>S3 Log Destination</h2>
<p>&#x3C;img
src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/95d0af58-a754-6825-7a2b-df8d3a81de3b.png"
style={{
clipPath: "inset(5px 5px 5px 5px)",
}}
/></p>
<p>Common Fate can now send audit log events to an <a href="https://docs.commonfate.io/integrations/s3-log-destination">Amazon S3 bucket</a>. This allows you to maintain an archive of actions taken within Common Fate or to build custom reports based on access activity and gain insights into access patterns.</p>
<h2>Granted Updates</h2>
<p>In our ongoing commitment to enhancing Granted, we're excited to share the latest updates:</p>
<p><strong>Common Fate built-in Profile Registry</strong></p>
<p>Granted can now automatically <a href="https://docs.commonfate.io/granted/usage/profile-registry#common-fate-built-in-profile-registry">sync AWS profiles for available roles in Common Fate</a>. This feature automatically syncs available AWS profiles into your ~/.aws/config file.</p>
<p><strong>Enhancements to Granted's SSO Populate/Generate</strong></p>
<p>Starting from version <a href="https://github.com/common-fate/granted/releases/tag/v0.25.0">v0.25.0</a>, Granted now allows configurations for granted sso generate and granted sso populate to be persisted in the Granted config file (~/.granted/config by default). This update also includes support for using <a href="https://masterminds.github.io/sprig/">Sprig</a> template functions, enhancing customization options.</p>
<p>A big shoutout to our first-time contributors:</p>
<ul>
<li><a href="https://github.com/mikesarver">@mikesarver</a> made their first contribution in <a href="https://github.com/common-fate/granted/pull/648">#648</a></li>
<li><a href="https://github.com/ckluy31">@ckluy31</a> made their first contribution in <a href="https://github.com/common-fate/granted/pull/663">#663</a></li>
</ul>
<p>For a comprehensive list of changes, please visit our <a href="https://github.com/common-fate/granted/releases">changelog</a>.</p>
<p>Your voice shapes our tools. We value your feedback, suggestions, and ideas, so please don't hesitate to get in touch.</p>
<p>Until next time,</p>
<p>The Common Fate Team</p>


# Community Newsletter: June 2024

Hey everyone! Shwetha here with the latest tech update. If you're eager for deeper insights and real-time updates, make sure to join our [Slack community](https://join.slack.com/t/commonfatecommunity/shared_invite/zt-q4m96ypu-_gYlRWD3k5rIsaSsqP7QMg) or follow us on [Twitter](https://twitter.com/CommonFateTech).

Here's what's been happening in the world of Common Fate over the past month:

### Our latest blog post: **Simplifying Just-in-Time Access Governance using Cedar**

Check out our latest blog post in which AWS IAM expert Rowan Udell has conducted a deep dive into AWS's open-source policy language Cedar and how we utilize it for Just-In-Time access [here](https://www.commonfate.io/blog/jit-using-cedar). Want to learn more about how we use Cedar? Book a live demo using [**this link**](https://savvycal.com/common-fate/d3c7f2e9).

![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/1e19494a-fd96-89f4-14eb-24dc8699abdf.png)

### Featured at re:Inforce

We were pleasantly surprised to be acknowledged by AWS recently during the re:Inforce 2024 keynote for our utilization of Cedar. Our work with Cedar showcases how the open-source policy language can be used to control your access management. We are proud to be at the forefront of this new technology!

![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/e7114543-d4cb-ad66-c0a4-3ba97e66b24f.png)

## New Request UI

We're excited to announce improvements to our request access UI. The new interface now displays the AWS organizational unit and GCP folder that accounts belong to, providing a better context for users. Additionally, the web console now encourages users to select read-only/view-only access by default, though other roles remain available via the drop-down menu.

![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/d2ffc9ca-28dc-c30b-990e-ecc6701810b5.png)

## Breakglass Access

We have recently added Breakglass access, which allows a user to optionally bypass approval requirements on an access request in situations where immediate access is required. By default, no Breakglass access is permitted in your Common Fate deployment.
![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/3c507757-cecb-d4b5-87df-4cbcc6e95740.png)

## Granted Updates

In our ongoing commitment to enhancing Granted, we're excited to share the latest updates:

**Support for Firefox Nightly**

You can now use Granted with Firefox's Nightly browser. To set this up, run `granted browser set` , select `Firefox Nightly`, and enter the path to your browser. Thanks, [@meuxx](https://github.com/meuxx) for this contribution.

**Added the option to clear the entire Granted cache**

You can now run `granted cache clear --all` and choose which secure storage you want to clear the cache. The command will then clear all credentials for the selected secure storage.

A big shoutout to our first-time contributor:

- [@meuxx](https://github.com/meuxx) made their first contribution in [#685](https://github.com/common-fate/granted/pull/685)

For a comprehensive list of changes, please visit our [changelog](https://github.com/common-fate/granted/releases).

Your voice shapes our tools. We value your feedback, suggestions, and ideas, so please don't hesitate to get in touch.

Until next time,

The Common Fate Team


Here's our product and community news for June.

Community Newsletter: June 2024


# Simplifying Just-in-Time Access Governance using Cedar

In a modern and secure cloud environment, just-in-time access is the pinnacle of best practice security and governance. By only provisioning access when it’s required, you limit the blast radius of any access granted, while still enabling your developers and engineers to build and maintain your systems productively.

Doing this at scale can be challenging, and the downsides of getting something wrong are scary, so building a solution with the right tools is critical to success.

This post will show the benefits of using [Cedar](https://www.cedarpolicy.com/) to control your access management, as used by [Common Fate](https://www.commonfate.io/solutions/pam).

## Cedar policy language

Cedar is an open source language developed by AWS, made specifically for writing policies to secure your applications. It’s similarities to the AWS IAM policy syntax are easy to see, and [the academic paper behind it](https://arxiv.org/pdf/2403.04651) is as extensive as you would expect from any piece of research. The project has [extensive documentation](https://docs.cedarpolicy.com/) and [supporting resources](https://github.com/cedar-policy/cedar-awesome).

## Just-in-time access with Common Fate

Common Fate is an authorization engine for just-in-time cloud access management. Principals (aka. users) can make requests for [grants](https://docs.commonfate.io/setup/glossary#grant) that allow time-bound access to [entitlements](https://docs.commonfate.io/setup/glossary#entitlement), like AWS accounts, GCP projects, and more. Grants can be requested, approved, closed, or activated (once approved).

<figure>
  <img
    src="/images/access-flow.png"
    alt="Grant request lifecycle in Common Fate"
  ></img>
  <figcaption>Grant request lifecycle in Common Fate.</figcaption>
</figure>

### Allow access requests

The first, and most important permission statement is to allow principals to make a request for access, which all principals can do with the following policy:

```rust
@advice("Anyone can request access")
permit (
    principal,
    action == Access::Action::"Request",
    resource
);
```

This statement allows all principals to use the `Access::Action::"Request"` action on all resources, which in the context of Common Fate is [a Grant](https://docs.commonfate.io/setup/glossary#grant): time-based access to an entitlement, such as an AWS account or GCP project (among others).

The `@advice` syntax allows us to [annotate](https://docs.cedarpolicy.com/policies/syntax-policy.html#term-parc-annotations) our policy statements, and has no effect on evaluation. In Common Fate, the annotation is showing in the interface alongside the impact for clarity and to explain intent:

<figure>
  <img
    src="/images/request.png"
    alt="Advice annotations appear alongside entitlements in Common Fate"
  ></img>
  <figcaption>
    Advice annotations appear alongside entitlements in Common Fate.
  </figcaption>
</figure>

### Enforce governance

With a request in progress, we now want to ensure that only the right users (aka. principals) can approve the access. Specifically, we want to prevent principals from approving their own requests:

```rust
@advice("You cannot approve your own access request")
forbid (
    principal,
    action == Access::Action::"Approve",
    resource
)
when { principal == resource.principal };

```

As with other statements, the `resource` is a grant, and by checking the resource’s principal (that is, the principal that created the grant), we can `forbid` them from taking the “Approve” action.

### Manage requests

Preventing principals from approving their own requests doesn’t mean they can’t do anything to their requested grants. It’s perfectly reasonable for them to close their own requests that they no longer need:

```rust
@advice("You can close your own access request")
permit (
    principal,
    action == Access::Action::"Close",
    resource
)
when { principal == resource.principal };
```

Using the same `when` clause as the previous statement, we can give principals control over their own access requests, but not other principals.

### Centralize request management

Even if principals can’t approve their own access request, someone has to be able to! This statement allows a specific group of principals to approve or close (reject) a request for access:

```rust
@advice("The security team can approve or close access requests")
permit (
    principal in Entra::Group::"ID_OF_SECURITY_GROUP",
    action in [ Access::Action::"Approve", Access::Action::"Close" ],
    resource
);
```

[Common Fate integrates with identity providers like Microsoft Entra](https://docs.commonfate.io/integrations/sso/entra), so this particular statement relies on a specific ID for the [Entra group](https://learn.microsoft.com/en-us/entra/fundamentals/concept-learn-about-groups) of the security team to ensure that only the right principals can perform critical actions.

## Access management made easy

Access request approvals are also a good example of the flexibility of Cedar. Who can or should approve specific requests varies greatly between different organizations, but Cedar can be used to define them explicitly and concisely.

### Policy-as-code

Another benefit of Cedar is it allows you to adopt _authorization-as-code_. As a technology team, you already have great governance controls around source code - your software development lifecycle! Using Cedar means that you can _reuse_ these same processes that you already have, and use existing tools like GitHub for policy review.

<figure>
  <img
    src="/images/ga.png"
    alt="Annotations show issues with Cedar policies inline for easy resolution, before they get deployed."
  ></img>
  <figcaption>
    Annotations show issues with Cedar policies inline for easy resolution,
    before they get deployed.
  </figcaption>
</figure>

We provide a [Validate Cedar Policies GitHub Action](https://github.com/marketplace/actions/validate-cedar-policies) in the GitHub Marketplace that can be used in your own projects, as well as with Common Fate.

By using a purpose-built language with an established pedigree, common [footgun](https://en.wiktionary.org/wiki/footgun) scenarios are completely mitigated, and access management is streamlined without sacrificing speed or security. The clarity and customizability that Cedar provides means that policies can be verified by security teams without resorting to custom code solutions that increase complexity and maintenance cost.

Want to know more? [Get a demo](https://savvycal.com/common-fate/d3c7f2e9?sid=f3d2ed6e-baaf-486d-9e2e-3ca82717230d) of the Common Fate platform.


The benefits of using Cedar to control your access management with Common Fate

Simplifying Just-in-Time Access Governance using Cedar


We are now publishing signed Debian releases of [Granted](https://granted.dev) to an APT repository, hosted at `https://apt.releases.commonfate.io`. If you are using Ubuntu or another Debian-based operating system, you can add our repository with the following command:

```bash
wget -O- https://apt.releases.commonfate.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/common-fate-linux.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/common-fate-linux.gpg] https://apt.releases.commonfate.io stable main" | sudo tee /etc/apt/sources.list.d/common-fate.list
```

After adding the repository, you can install and update Granted with:

```bash
sudo apt install granted
```

Our APT repository is hosted on AWS, using S3 and CloudFront to maximise package availability. We've also published [linuxpack](https://github.com/common-fate/linuxpack), an open-source project we are using to package and publish releases to the APT repository.

Our APT packages include the same Linux binaries published to `https://releases.commonfate.io`. You can find the full installation instructions in the [Granted documentation](https://docs.commonfate.io/granted/getting-started#installing-the-cli).

Our Linux releases are signed with a separate PGP key, available at `https://apt.releases.commonfate.io/gpg`. The key's fingerprint is `783A 4D1A 3057 4D2A BED0 49DD DE9D 631D 2D1D C944`. We've updated our [security documentation](https://docs.commonfate.io/granted/security) to include details on the key.


Installing Granted on Linux is now easier with our new APT repository.

The Common Fate Linux Repository


# Community Newsletter: May 2024

Hey everyone! Shwetha here with the latest tech update. If you're eager for deeper insights and real-time updates, make sure to join our [Slack community](https://join.slack.com/t/commonfatecommunity/shared_invite/zt-q4m96ypu-_gYlRWD3k5rIsaSsqP7QMg) or follow us on [Twitter](https://twitter.com/CommonFateTech).

Here's what's been happening in the world of Common Fate over the past month:

## **GCP Role Group**

![](https://mcusercontent.com/69860be79239e5e8d492037c9/images/435ad2cf-3186-6721-5eb1-8914aacec306.png)

Common Fate now supports [GCP Role Groups](https://docs.commonfate.io/integrations/gcp#gcp-role-group-access). This feature allows you to streamline permissions across multiple GCP roles by defining role groups. Role groups enable you to bundle multiple predefined roles, such as folder admin and owner, into a single entity. Users can then request access to these role groups for GCP projects or folders. GCP Role Groups allow you to work around the permission count restriction in custom roles.

## **Auth0 integration**

<img
  src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/957cc4f5-1a75-72d2-5ea2-e13acd7945b6.png"
  style={{
    backgroundColor: "white",
  }}
/>

Common Fate now integrates with [Auth0](https://auth0.com/) to provision Just-In-Time access. This integration allows users to request temporary access to Auth0 Organizations.

## S3 Log Destination

<img
  src="https://mcusercontent.com/69860be79239e5e8d492037c9/images/95d0af58-a754-6825-7a2b-df8d3a81de3b.png"
  style={{
    clipPath: "inset(5px 5px 5px 5px)",
  }}
/>

Common Fate can now send audit log events to an [Amazon S3 bucket](https://docs.commonfate.io/integrations/s3-log-destination). This allows you to maintain an archive of actions taken within Common Fate or to build custom reports based on access activity and gain insights into access patterns.

## Granted Updates

In our ongoing commitment to enhancing Granted, we're excited to share the latest updates:

**Common Fate built-in Profile Registry**

Granted can now automatically [sync AWS profiles for available roles in Common Fate](https://docs.commonfate.io/granted/usage/profile-registry#common-fate-built-in-profile-registry). This feature automatically syncs available AWS profiles into your ~/.aws/config file.

**Enhancements to Granted's SSO Populate/Generate**

Starting from version [v0.25.0](https://github.com/common-fate/granted/releases/tag/v0.25.0), Granted now allows configurations for granted sso generate and granted sso populate to be persisted in the Granted config file (~/.granted/config by default). This update also includes support for using [Sprig](https://masterminds.github.io/sprig/) template functions, enhancing customization options.

A big shoutout to our first-time contributors:

- [@mikesarver](https://github.com/mikesarver) made their first contribution in [#648](https://github.com/common-fate/granted/pull/648)
- [@ckluy31](https://github.com/ckluy31) made their first contribution in [#663](https://github.com/common-fate/granted/pull/663)

For a comprehensive list of changes, please visit our [changelog](https://github.com/common-fate/granted/releases).

Your voice shapes our tools. We value your feedback, suggestions, and ideas, so please don't hesitate to get in touch.

Until next time,

The Common Fate Team
