Disclaimer: This project is a Proof of Concept (POC), entirely generated by AI. It has not been audited for production use. Review all code, configurations, and IAM permissions thoroughly before deploying to any environment handling real workloads.

SSM Access Manager

A Slack-integrated system for managing temporary AWS Systems Manager (SSM) document access with approval workflows.

Overview

SSM Access Manager allows users to request temporary access to AWS resources through Slack. Access requests require two-tier approval from configured Slack user groups (security and manager), and the system automatically creates time-limited SSM documents with ABAC (Attribute-Based Access Control) tags.

Key Features

• 🔐 Slack-based Access Requests - Users request access via /ssm-access command
• ✅ Two-Tier Approval Workflow - Security and manager approvals via Slack user groups
• 👥 Group-based Approvals - Manage approvers through Slack user groups
• 🔄 Real-time Updates - Approval messages update instantly for all group members
• ⏰ Time-based Expiration - Documents automatically expire and are cleaned up
• 🏢 Multi-Account Support - Manage access across multiple AWS accounts
• 📊 Audit Trail - All actions logged to CloudWatch with structured logging
• 🔒 ABAC Tags - Documents tagged with user identity for fine-grained access control

Quick Start

Get up and running in ~1 hour:

# 1. Build Lambda functions
./scripts/build.sh

# 2. Deploy infrastructure
./scripts/deploy.sh test us-east-1

# 3. Configure Slack app with endpoints from Terraform output

# 4. Add yourself as administrator
./scripts/add-user.sh test YOUR_USER_ID your.name your@email.com administrator us-east-1

# 5. Create Slack user groups and configure approval groups
/ssm-admin add-approval-group group_id=YOUR_SECURITY_GROUP_ID name="Security Team" type=security
/ssm-admin add-approval-group group_id=YOUR_MANAGER_GROUP_ID name="Manager Team" type=manager

# 6. Test in Slack
/ssm-admin help
/ssm-access

Full setup guide: See QUICKSTART.md

Architecture

┌─────────────┐
│   Slack     │
│   Users     │
└──────┬──────┘
       │ /ssm-access
       │ /ssm-admin
       ▼
┌─────────────────────────────────────────┐
│         API Gateway                      │
│  /slack/command  /slack/admin           │
│  /slack/interaction  /admin             │
└──────┬──────────────────────────────────┘
       │
       ▼
┌─────────────────────────────────────────┐
│         Lambda Functions                 │
│  • Request Handler                       │
│  • Approval Handler                      │
│  • Admin Slack Handler                   │
│  • Document Creator                      │
│  • Expiration Cleanup                    │
└──────┬──────────────────────────────────┘
       │
       ▼
┌─────────────────────────────────────────┐
│         DynamoDB Tables                  │
│  • Access Requests                       │
│  • SSM Documents                         │
│  • Users (Administrators)                │
│  • AWS Accounts                          │
│  • Approval Groups                       │
└─────────────────────────────────────────┘
       │
       ▼
┌─────────────────────────────────────────┐
│    Target AWS Accounts                   │
│  • Assume IAM Role                       │
│  • Create/Delete SSM Documents           │
└─────────────────────────────────────────┘

User Roles

• User: Can request access via /ssm-access
• Approval Group Member: Can approve/deny requests (managed via Slack user groups)
• Administrator: Can manage approval groups, administrators, and accounts via /ssm-admin

Slack Commands

For All Users

/ssm-access

Opens a modal to request temporary access to a resource. Fill in:

• Host (hostname or IP)
• Port (default: 22)
• AWS Account (dropdown)
• Manager Group (dropdown)
• Expiration Date (optional, defaults to 14 days)

For Administrators

/ssm-admin add-approval-group group_id=<id> name=<name> type=<security|manager>  # Add approval group
/ssm-admin list-approval-groups                                                   # List approval groups
/ssm-admin add-admin @user                                                        # Add an administrator
/ssm-admin remove-admin @user                                                     # Remove an administrator
/ssm-admin list-admins                                                            # List all administrators
/ssm-admin approve-request <request_id>                                           # Approve a request
/ssm-admin deny-request <request_id> <reason>                                     # Deny a request
/ssm-admin help                                                                   # Show all commands

Documentation

Getting Started

• QUICKSTART.md - Complete setup and deployment guide (~1 hour)

User Guides

• docs/USER_GUIDE.md - How to request and use access
• docs/ADMIN_GUIDE.md - Administrator management and operations

Operations

• docs/OPERATIONS.md - Day-to-day operations and monitoring

Prerequisites

• AWS CLI configured with admin credentials
• Terraform >= 1.0
• Go >= 1.25
• Slack workspace with app installation permissions
• At least one AWS account for target resources

Customization

Document Prefix

Customize the SSM document naming prefix to match your organization's conventions:

# In Terraform variables
export TF_VAR_document_prefix="ACME"  # Default: "PF" (PortForwarding)

Documents will be named: {PREFIX}-{username}-{host}-{port}

• Default: PF-john.doe-db.example.com-5432
• Custom: ACME-john.doe-db.example.com-5432

The prefix must:

• Start with an alphanumeric character
• Contain only alphanumeric, hyphens, and underscores
• Be 20 characters or less

Technology Stack

• Language: Go 1.25+
• Infrastructure: Terraform
• Cloud: AWS (Lambda, DynamoDB, API Gateway, SSM, IAM)
• Integration: Slack API
• Logging: CloudWatch with structured JSON logs

Security Features

• Slack signature verification for all requests
• Two-tier approval system (security + manager)
• Group-based access control via Slack user groups
• Time-limited access with automatic expiration
• ABAC tags on SSM documents for fine-grained control
• Audit trail in CloudWatch logs
• PII sanitization in logs
• IAM role assumption with credential caching

Project Structure

.
├── cmd/                    # Lambda function handlers
│   ├── request-handler/    # /ssm-access command
│   ├── approval-handler/   # Approval button interactions
│   ├── admin-slack-handler/# /ssm-admin command
│   ├── document-creator/   # SSM document creation
│   ├── expiration-cleanup/ # Cleanup expired documents
│   └── admin-handler/      # Admin REST API
├── internal/               # Internal packages
│   ├── models/            # Data models
│   ├── repository/        # DynamoDB repositories
│   ├── service/           # Business logic
│   ├── slack/             # Slack client
│   ├── validation/        # Input validation
│   └── logging/           # Structured logging
├── infrastructure/        # Terraform configurations
│   └── terraform/
├── scripts/               # Helper scripts
├── docs/                  # Documentation
└── QUICKSTART.md         # Quick start guide

Contributing

Contributions are welcome! Please:

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests if applicable
5. Submit a pull request

License

This project is licensed under the Apache License 2.0.

Support

• Issues: Report bugs or request features via GitHub Issues
• Documentation: See docs/ directory for detailed guides
• Logs: Check CloudWatch logs for troubleshooting

Acknowledgments

Built with:

• AWS SDK for Go v2
• Slack Go SDK
• Terraform AWS Provider
• Zap Logger