Accessing accounts
Pick an account from the dropdown at the top of the dashboard, and you'll land on its page. From there you can open the AWS console or take credentials for your terminal.
Opening the console
Open console signs you straight into the AWS console for that account, in the region the account is configured for. No password, no account number to remember, no switching roles once you're in — you arrive already in the right place as the right role.
The console session lasts the same hour as everything else. When it lapses, AWS drops you back to its own sign-in page; come back to GateKeeper and open the console again rather than trying to log in there.
Getting credentials
Get credentials gives you a set of temporary AWS keys to paste into a terminal. They work with the AWS CLI, Terraform, the SDKs — anything that reads the standard environment variables.
They expire within the hour. When they do, commands start failing with an expired-token error and you'll need a fresh set.
If you do this more than occasionally, use the gatekeeper CLI instead.
One command puts credentials straight into your shell, and it renews them for you rather than
sending you back to the browser every hour.
Choosing a permission
Each account offers up to three levels:
| Permission | What it's for |
|---|---|
| ReadOnly | Looking: logs, metrics, configuration. Can't change anything. |
| PowerUser | Building and changing resources, but not managing IAM users or roles. |
| Administrator | Everything, including IAM. |
You'll only be offered what you're entitled to, and GateKeeper defaults to the strongest you hold so the common case is one click.
Take the lowest that does the job. If you're reading logs on a production account, ask for ReadOnly. A read-only session can't be the thing that caused an outage, and that's worth something both to you and to whoever investigates. This isn't a formality — the permission you pick is the permission the session actually has.
Registering a new account
If you have the manage accounts capability, the dashboard also lets you register one. Doing so generates a CloudFormation template — Download roles template on the account's settings page — which the target account's owner deploys into their AWS account. Until they do, GateKeeper can't reach it, and nobody will be able to get a session for it however their access is configured.
The template is generated per account and already filled in. Don't reuse one account's template for another; the values inside it are specific to the account it was generated for.