GateKeeper

GateKeeper is how GCD Tech developers get into client AWS accounts. Instead of long-lived access keys sitting on laptops, you sign in with your @gcdtech.com Google account and GateKeeper hands you a short-lived session for the account you asked for — in the browser, or in your terminal.

It also looks after the two bits of your own setup that most client environments need: the IP address you connect from, and your SSH public keys.

The idea in one minute

  • You never hold permanent credentials. Every session GateKeeper issues expires within the hour. Nothing to rotate, and nothing useful to steal from a stolen laptop.
  • Access is checked every time you ask. Your access isn't baked into a key when it's granted; it's looked up at the moment you request a session. When someone revokes it, the next request stops working — you don't wait for anything to expire.
  • You choose how much power you need. If you're entitled to Administrator on an account you can still ask for a read-only session, and that's usually the right call.

What you can do

I want to… Go to
Open the AWS console for a client account Accessing accounts
Get AWS credentials in my terminal Command line
Whitelist my IP or add an SSH key Your details
Understand why I can't see an account Permissions
Fix something that isn't working Troubleshooting

If you're new, read Signing in first — it's short, and it explains the one-hour session rule that everything else follows from.

All pages

  • Signing in

    GateKeeper uses your GCD Tech Google account. There is no separate password, and there's nothing to set up the first time — but somebody does have to create your account before you can get in.

  • Your details

    Two things on the dashboard are yours alone: the IP address you connect from, and your SSH public keys. Client environments use these to let you through — a bastion host that only accepts connections from known addresses, or a server that trusts your key.

  • Accessing accounts

    Pick an account from the dropdown at the top of the dashboard, and you'll land on its page. From there you can open the AWS console or take credentials for your terminal.

  • Command line

    `gatekeeper` does from a terminal what the dashboard does in a browser: signs you in, then puts credentials for a client account into your shell.

  • Permissions

    Two separate things decide what you can do, and they don't interact. Knowing which is which saves a lot of confusion when something isn't available.

  • Troubleshooting

    ## "No GateKeeper account exists for this email"