Finding the right balance of speed and security through just-in-time access to cloud resources

Summary

Ramp’s rapid growth exposed problems in its AWS access model: three broad roles created persistent production access for some senior engineers while junior engineers depended on seniors for queries. The team first reorganized permissions into more than 20 team-specific AWS Identity Center groups, each backed by permission sets and a Terraform module that presents IAM configuration through human-readable resource lists. It then introduced just-in-time access through ConductorOne by pairing each non-production role with an elevated production role, removing standing production access and provisioning entitlements through AWS SSO group membership. Team-owned requests were automatically approved, while cross-team requests went to the relevant tech lead, with temporary access and backup approval handling described in the design. The resulting model reduced exposure, preserved fast access to needed resources, and recorded production activity for accountability and audit purposes.

Context

Ramp’s growth from fewer than 100 employees to more than 600 made its three-role AWS access model increasingly problematic. Senior engineers retained more production access than necessary, increasing the impact of mistakes or compromised accounts, while junior engineers had to ask senior colleagues to run queries because their access was too limited. Infrastructure engineers also had to modify IAM policies for individual requests, creating operational friction.

Approach / What changed

The team established fine-grained AWS Identity Center groups for more than 20 engineering teams, attached tailored permission sets, and used a Terraform module to abstract IAM statements through human-readable team configuration. It then created elevated production roles as supersets of non-production roles and used ConductorOne entitlements to provision temporary access through AWS SSO group membership. Requests for a team’s own production role were immediately approved; cross-team requests were routed to the owning team’s tech lead.

Takeaways

• Replacing three broad AWS roles with more than 20 team-specific groups tied permissions to engineering ownership and responsibilities.
• Elevated production roles were separated from default roles, allowing eligible engineers to request temporary access instead of retaining standing production privileges.
• The implementation reduced the production exposure window while correlating access with customer issues or justifications and supporting access tracking for SOC 2 and ISO27001 controls.

Related reading