Documentation

Overview

JIT Guard provides temporary, audited AWS console access via Slack. It integrates with AWS IAM Identity Center to create ephemeral access groups — called elevations — that are automatically revoked when a timer expires. No stale credentials, no manual cleanup, no shared passwords.

Designed for incident response and emergency scenarios, JIT Guard lets authorised team members request access to any account in your AWS Organisation with a single /jit command in Slack. Access is time-bound (1–8 hours), fully logged, and removed automatically.

How It Works

  1. Request — A team member types /jit in Slack, selects an account, picks a duration (1h, 2h, 4h, or 8h), and provides a reason.
  2. Evaluate — The request is evaluated against your team's policies. On-call engineers and designated approvers can auto-approve or approve via Slack DM.
  3. Elevate — JIT Guard creates an ephemeral IAM Identity Center group, assigns the JIT Guard permission set to the target account, and adds the user. The user receives a confirmation DM with the expiry time.
  4. Expire — When the timer elapses, the group is deleted, the user is removed from the permission set assignment, and an audit record is written. All done automatically.

Architecture

JIT Guard is a serverless SaaS running in the JIT Guard AWS account. Each customer deploys a lightweight CloudFormation stack in their own Identity Center management account that establishes a cross-account trust.

Key Components

  • Slack App — Entry point for elevation requests. Handles slash commands, interactive modals, and auto-complete for account selection.
  • Promote Lambda — Processes elevation requests from an SQS queue. Creates ephemeral Identity Center groups, assigns permission sets, and schedules automatic demotion via EventBridge Scheduler.
  • Demote Lambda — Triggered by EventBridge Scheduler when an elevation expires. Removes the Identity Center group assignment, deletes the group, and writes the audit record.
  • Org Sync — An EventBridge rule in your account forwards AWS Organisation events (account created, moved, etc.) to the JIT Guard event bus, keeping the account catalogue up to date.
  • DynamoDB — Single-table design with tenant isolation via composite keys. Stores customer config, account catalogue, organisation units, audit records, and Stripe billing data.
  • Billing — Stripe subscription management with monthly billing. Free trial included. Billing is processed asynchronously via SQS queues.

Prerequisites

  • AWS IAM Identity Center enabled in your AWS Organisation (formerly AWS SSO). Must be set up with at least one user and one permission set for JIT access.
  • AWS Organisations with the accounts you want to manage. The account catalogue syncs automatically via EventBridge.
  • A Slack workspace with the ability to install Slack apps. Bot token scopes are handled automatically during setup.
  • AWS CLI access to your Identity Center management account for CloudFormation deployment.

Getting Started

Follow these steps to connect your AWS organisation to JIT Guard. The process takes approximately 15 minutes.

Step 1: Sign Up

Visit the JIT Guard signup page and create your account. You'll receive a customer ID and a role ARN for the CloudFormation stack.

Step 2: Deploy the CloudFormation Stack

In your Identity Center management account, deploy the JIT Guard CloudFormation stack using the provided template. The stack creates:

  • An IAM role that JIT Guard assumes to manage Identity Center resources
  • An EventBridge rule that forwards Organisation events (account creation, moves, etc.) to the JIT Guard event bus

Use the AWS CLI or CloudFormation console to deploy. The only parameter is your JIT Guard customer ID.

Step 3: Connect Your AWS Organisation

Once the stack is deployed, return to the JIT Guard dashboard and click Connect. Enter your management account ID — JIT Guard discovers the rest (Identity Center instance, organisation structure, accounts) automatically.

Step 4: Install the Slack App

On the dashboard, follow the Slack app installation link. You'll be prompted to authorise the JIT Guard bot with the necessary scopes for your workspace. Once installed, the bot is ready to handle /jit commands.

Step 5: Start Elevating

Type /jit in any Slack channel or DM with the JIT Guard bot. Select an account, choose a duration, add a reason, and you're elevated. You'll receive a DM confirmation with the expiry time.

Slack Commands

/jit [account-id]

Request elevation to an AWS account. Two modes:

  • Quick promote — /jit 123456789012 elevates you to the specified account for 1 hour immediately. Useful when you know the account ID.
  • Modal promote — /jit (no arguments) opens an interactive modal with account auto-complete, duration selection (1h, 2h, 4h, 8h), and a reason field.

Dashboard

The JIT Guard web dashboard at https://app.jitguard.com provides:

  • Connection status — Whether your AWS organisation is connected and syncing properly
  • Account overview — View all accounts in your organisation, sorted by OU
  • Billing management — View your current plan and manage payment via the Stripe Customer Portal
  • Subscription status — See your tier (free trial / paid / expired) and next billing date

Account Catalogue

JIT Guard maintains a synchronised copy of your AWS Organisation's accounts and organisational units (OUs) in DynamoDB. This powers the auto-complete in the Slack modal, so users can search accounts by name or ID.

The catalogue is kept up to date via EventBridge: when accounts are created, moved, renamed, or removed in your organisation, an event is forwarded to JIT Guard and the catalogue is updated within seconds.

Billing & Plans

JIT Guard offers three tiers of service. All plans include a 3-month free trial with no credit card required.

  • Starter ($50/month) — Up to 10 AWS accounts, 30-day audit retention, Slack integration
  • Growth ($350/month) — Up to 50 AWS accounts, 90-day audit retention, PagerDuty on-call sync, Slack support channel
  • Enterprise (Custom) — Unlimited accounts, custom audit retention, dedicated support, SAML/SSO, AWS Marketplace

Billing is handled monthly via Stripe. You can view and manage your subscription at any time from the dashboard. Upgrade or downgrade at any time — upgrades take effect immediately with prorated billing.

Security Model

  • Tenant isolation — Each customer's data is stored under a unique partition key in DynamoDB. Access is scoped via IAM session policies that restrict operations to the customer's partition.
  • Cross-account access — JIT Guard assumes an IAM role in your Identity Center management account. The role is scoped to specific Identity Center actions (create/delete groups, assign permission sets) — JIT Guard has no access to your EC2, S3, or other AWS resources.
  • Encryption — All data is encrypted at rest via DynamoDB SSE. All API traffic uses TLS 1.2+.
  • Ephemeral groups — Elevation groups are prefixed with jitguard- and include a random UUID. Groups are automatically deleted when the elevation expires. This prevents accumulation of stale access.
  • Slack signature verification — All Slack requests are verified using HMAC-SHA256 with timing-safe comparison.

Audit Trail

Every elevation event is recorded as an immutable audit record in DynamoDB. Each record includes:

  • Event type — promote (access granted), demote (access expired), or failure
  • Identity — Slack user ID and resolved email address
  • Target — AWS account ID that was accessed
  • Duration — Requested duration in seconds
  • Reason — User-provided justification for the elevation
  • Timestamps — When access was granted and when it expired

Audit records are retained per your plan's retention policy (30 days for Starter, 90 days for Growth, custom for Enterprise). After the retention period, records are automatically purged via DynamoDB TTL.

Audit logs can be exported upon request — contact support for a data export.

Approval Workflows

JIT Guard supports configurable policies for elevation requests. Depending on your team's configuration:

  • Auto-approved — Users who are on-call (via PagerDuty sync) can be auto-approved for immediate elevation.
  • Requires approval — Elevations to sensitive accounts (e.g., production) or long durations can require one or more designated approvers to approve via Slack DM.
  • Audit-only — Log everything but don't block any requests.

Troubleshooting: no messages after pressing Promote

If the modal closes but you never see a confirmation, check that the JIT Guard app's Messages tab is enabled: open the app's home (click the JIT Guard app in the sidebar), open the About tab, and re-enable Messages. Direct-message confirmations require it. Your active promotions always appear on the app's Home tab regardless.

Configuring policies

Policies are configured per-customer and stored in your configuration record. Contact support to set up custom approval workflows for your team.

Frequently Asked Questions

What happens when my free trial ends?

If you don't subscribe before the trial expires, elevation requests are blocked with a Slack DM explaining that your free trial has ended. You can subscribe at any time from the dashboard billing page — access resumes immediately.

Can I cancel my subscription?

Yes. Cancel from the Stripe Customer Portal in the dashboard. Access continues until the end of the current billing period. Your data is retained for 30 days after cancellation, then deleted.

How are permissions scoped?

JIT Guard uses IAM Identity Center permission sets. You define the permission set (e.g., AdministratorAccess, PowerUserAccess, or a custom scoped set) in your Identity Center console, and JIT Guard assigns it to the ephemeral group during elevation.

Can I approve/deny requests from my phone?

Yes. Approval requests are sent as Slack DMs with approve/deny buttons. The Slack mobile app works great for this — no separate dashboard required.

What regions do you support?

Identity Center can be enabled in any region. JIT Guard automatically probes common regions to discover your SSO instance. Organisation APIs are global (us-east-1). The JIT Guard service runs in eu-west-1 (Ireland).

How is pricing calculated?

Pricing is per-organisation, not per-user. Every member of your Slack workspace can request elevations. There are no per-user or per-elevation fees within your plan's account limit.

Troubleshooting

I typed /jit but nothing happened

Ensure the JIT Guard Slack app is installed in your workspace and that you're typing the command in a channel where the bot is present, or in a DM with the bot.

I'm not receiving messages from the JIT Guard bot

Status updates and confirmation messages arrive in the app's Messages tab. If it's not there, open the JIT Guard app in Slack (search for it in the app launcher), go to App Home, and turn on the Messages tab.

The account auto-complete is empty

The account catalogue syncs via EventBridge from your AWS Organisation. If no accounts appear, verify that the CloudFormation stack was deployed successfully and that your organisation has accounts. The sync runs on initial connection and then via event forwarding.

I got an "access denied" error during elevation

Verify that the JIT Guard IAM role in your account has the necessary permissions for Identity Center (create/delete groups, assign permission sets). The CloudFormation stack template includes the required policy — check that it wasn't modified.

The dashboard shows "Disconnected"

This means JIT Guard can no longer assume the cross-account role. This can happen if the role was deleted, its trust policy was modified, or the management account ID changed. Re-deploy the CloudFormation stack or contact support.

Support

Email support@jitguard.com for help with any issues. Enterprise customers receive a dedicated Slack support channel.