Permissions

Two separate things decide what you can do, and they don't interact. Knowing which is which saves a lot of confusion when something isn't available.

What you can do inside GateKeeper

Your role controls the GateKeeper site itself — whether you can manage users, issue access to others, or register accounts. Most people have the plain User role, which is everything in these docs except the administrative panels.

If a panel or button isn't there, that's your role. Being an administrator on fifty AWS accounts doesn't change it.

Which accounts you can reach

Entirely separate, and it comes from up to four places:

• Global access — a permission on every registered account. Rare, and deliberately so.
• Your own grants — specific accounts assigned to you directly.
• Access groups — a named bundle, like a team or a client. Join the group, inherit its accounts. This is how most access is given.
• Temporary grants — one account, for a limited time, up to six months.

Where several apply, the strongest wins. If a group gives you ReadOnly on an account and somebody grants you Administrator on it directly, you have Administrator — and you can still ask for a ReadOnly session when that's all you need.

Why an account might not appear

The dropdown lists every registered account, not just yours — so seeing an account doesn't mean you can get into it. Choose one you have no access to and GateKeeper will say so plainly.

If an account is missing entirely, it hasn't been registered yet, which is a different problem from not having access to it.

Why access might stop working

Access is checked at the moment you ask for a session, not when it was granted. So:

• A revoked grant stops working on your next request. A session already in your hands runs its hour out.
• A temporary grant simply stops when it expires. Nothing warns you first.
• Someone can lose access to an account by being removed from a group, without anyone touching their account directly.

If access disappears unexpectedly, an expired temporary grant or a group change is nearly always the reason.

Asking for access

Ask whoever administers GateKeeper for your team. Useful to include:

• the account — its name or 12-digit id;
• the permission you need, and ideally the lowest that does the job;
• whether it's ongoing or for a specific piece of work. If it's for a piece of work, say so and ask for a temporary grant. Access that expires on its own is better for everyone than access someone has to remember to remove.