What CyberNest Access does between "I need prod" and "session closed"
One workflow covers the request, the approval, the connection, the recording and the revocation. Here is each part and how it behaves.
Requests and approval rules
Each resource carries a rule: who may request it, who approves, the default duration and the hard maximum. Requests need a reason and can require a ticket ID from Jira or Linear.
- Approve or deny in Slack, email, the web console or on mobile
- Two-person approval for writes on production databases
- Auto-approve for on-call engineers during their PagerDuty shift
- Requesters cannot approve their own grants
Approval rules
| Resource group | Approvers | Default / max |
|---|---|---|
| prod-databases Postgres, MySQL | 2 of platform-leads | 60 min / 4 h |
| prod-k8s EKS, GKE | 1 of sre | 2 h / 8 h |
| ssh-bastions Ubuntu, Amazon Linux | Auto for on-call | 30 min / 12 h |
| contractor-staging Mixed | 1 of eng-managers | 4 h / 12 h |
SSH, databases and Kubernetes through one proxy
Engineers keep their tools. The CyberNest CLI writes a temporary entry to your kubeconfig or opens a local port for psql, mysql and mongosh. Credentials are minted per grant and never land on disk as long-lived secrets.
- SSH
- OpenSSH certificates
- Kubernetes
- kubectl, Helm, k9s
- Databases
- Postgres, MySQL, MongoDB
- Web apps
- Internal admin panels
$ cybernest request prod-orders-pg --role read_only --for 60m --reason INC-4410Waiting for approval from platform-leads (2 required)...Approved. Grant REQ-2291 active until 15:31$ cybernest db connect prod-orders-pgListening on 127.0.0.1:55432. Run: psql -h 127.0.0.1 -p 55432$ cybernest kube login eks-prod-us-eastContext cybernest/eks-prod-us-east added, role view, expires in 2h
Session recording and replay
SSH and kubectl exec sessions are recorded keystroke by keystroke. Database sessions log each statement with timing and row counts. Recordings link back to the request, reason and approver.
- Replay in the browser or download as asciinema v2
- Audit log export as JSON or CSV, or streamed to your SIEM on Scale
- Retention of 30 days on Team, 1 year on Scale, custom on Enterprise
Session REQ-2287 · bastion-api-03
- Contractor requested ssh access, reason INC-4407 15:08
- Policy approved by on-call rule 15:09
- connected as ubuntu, recording started 15:12
- ran sudo systemctl restart api.service 15:19
- grant expired, connection closed 15:42
Deployment, identity and platform support
Connectors
Outbound-only. Run two per network for failover.
- Docker container
- Debian / RPM Linux packages
- AWS, Azure and Google Cloud VMs
- Kubernetes Helm chart
Identity and device checks
SAML or OIDC sign-in, SCIM group sync, WebAuthn security keys for approvers.
- Okta, Microsoft Entra ID
- Google Workspace, JumpCloud
- Device posture: Intune, Jamf, Kandji
- EDR signal: CrowdStrike, SentinelOne
Clients
CLI for engineers, web console for reviewers and admins.
- CLI for macOS, Windows, Linux
- Web console in current browsers
- Mobile approvals on iOS and Android
- Slack and email approval actions