策略引擎>> privx-on-aws>> 返回
项目作者： SSHcom

项目描述 ：
PrivX - Just-in-time Access Management
高级语言： TypeScript
项目地址: git://github.com/SSHcom/privx-on-aws.git
创建时间： 2019-12-10T08:58:59Z
项目社区：https://github.com/SSHcom/privx-on-aws
开源协议：Apache License 2.0
下载


PrivX - Just-in-time Access Management

Available as Infrastructure as a Code on AWS for fast deployment.

PrivX is a lean and modern privileged access management solution to automate your AWS, Azure and GCP infrastructure access management in one multi-cloud solution. While it offers super great cloud experience, you can also easily connect your on-prem infrastructure to it for a single pane of glass access control and monitoring. This project further simplifies PrivX on-boarding experience with deployment automation using infrastructure as a code tooling.

Build Status
Coverage Status
Git Hub
Community

Inspiration

Having seen how permanent passwords and left-behind and forgotten SSH keys enable access to critical environments years after they were actually created and needed, we started the PrivX project in order to get rid of the passwords and keys – to get rid of any permanent access altogether. We wanted to build a solution that only grants access when it’s needed & on the level needed. Later on this approached was coined Just-in-Time-Access and the method as Zero Standing Privileges (ZSP) by industry analysts while part of the larger Zero Trust trend of always (re-)verifying a user before any access is granted.

PrivX automates the process of granting and revoking access by integrating & fetching identities and roles from your identity management system (LDAP, AD etc) and ensures your engineering and admin staff have one-click access to the right infrastructure resources at the right access level. You will also get full audit trail and monitoring - vital if you are handling sensitive data or for example open access for third parties to your environment.

Learn more about PrivX and get your trial license.

To learn how PrivX works, please check out this video.

SSH experience



RDP experience



Getting Started

The latest version of Infrastructure as a Code is available at master branch of the repository. All development, including new features and bug fixes, take place on the master branch using forking and pull requests as described in contribution guidelines.

Requirements

  1. We are using AWS CDK and TypeScript to code PrivX infrastructure components. You have to configure your environment with node and npm version 10.x or later and install required components.
  1. ## with brew on MacOS
  2. brew install node
  4. ## then install CDK
  5. npm install -g typescript ts-node aws-cdk

  1. Obtain access to target AWS Account. You shall have ability to create/delete AWS resources.

  2. Obtain subdomain, domain name(s) and configure AWS Route53 HostedZone. If you have a fresh AWS Account or missing domain name, you can request one from AWS.

Deployments

Use AWS CDK command line tools to deploy PrivX to your AWS Account. Please note, the process consists of multiple stages:

  1. ##
  2. ## 1. clone privx-on-aws repository locally
  3. git clone https://github.com/SSHcom/privx-on-aws
  4. cd privx-on-aws
  6. ##
  7. ## 2. pre-config deployment process by configure environment and
  8. ##    installing dependent components  
  9. export AWS_ACCESS_KEY_ID=Your-Access-Key
  10. export AWS_SECRET_ACCESS_KEY=Your-Secret-Key
  11. export CDK_DEFAULT_ACCOUNT=Your-Account-Id
  12. export CDK_DEFAULT_REGION=eu-west-1
  13. export AWS_DEFAULT_REGION=eu-west-1
  14. npm install
  16. ##
  17. ## 3. configure and bootstrap target AWS region with AWS CDK.
  18. ##    Please note, the process requires domain name here.
  19. ##    the corresponding hosted zone must be properly configured otherwise
  20. ##    deployment fails.
  21. cdk bootstrap aws://${CDK_DEFAULT_ACCOUNT}/${CDK_DEFAULT_REGION} \
  22.   -c domain=example.com
  24. ##
  25. ## 4. deploy PrivX, you need to define a few variables here
  26. ##    subdomain   unique name of your privx instance. 
  27. ##                DO NOT USE any non-alphabet characters including 
  28. ##                punctuation in the subdomain name
  29. ##
  30. ##    cidr        allocate unique class A network `cidr` block for AWS VPC
  31. ##                default value 10.0.0.0/16 fits to majority of deployments
  32. ##
  33. ##    email       address to deliver CloudWatch alerts
  34. ##
  35. ##    sshkey      AWS SSH key pair to access PrivX instance for debugging 
  36. ##                purpose, keep empty to disable ssh access 
  37. ##                See more about ssh key from AWS documentation
  38. ##                https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html
  39. ##
  40. cdk deploy privx-on-aws \
  41.   -c cidr=10.0.0.0/16 \
  42.   -c subdomain=privx \
  43.   -c domain=example.com \
  44.   -c email=my.email@company.com \
  45.   -c sshkey=aws-keypair-name

In few minutes, your own instance of PrivX solution is available. Please check our playbook or raise GitHub issue if you have any troubles with deployment process. The deployment build entire PrivX architecture in your AWS account.

architecture

Open a Web browser with your fully qualified domain name, e.g. https://privx.example.com.

The login credentials for superuser is available in your AWS Account:

  1. Choose right region
  2. Goto AWS Secrets Manager > Secrets > KeyVault…
  3. Scroll to Secret value section
  4. Click Retrieve secret value

In the final step, please obtain a license code to activate your environment.

Next Steps

Bugs

If you experience any issues with the library, please let us know via GitHub issues. We appreciate detailed and accurate reports that help us to identity and replicate the issue.

  • Specify the configuration of your environment. Include which operating system you use and the versions of runtime environments.

  • Attach logs, screenshots and exceptions, in possible.

  • Reveal the steps you took to reproduce the problem, include code snippet or links to your project.

How To Contribute

The project is Apache 2.0 licensed and accepts contributions via GitHub pull requests:

  1. Fork it
  2. Create your feature branch (git checkout -b my-new-feature)
  3. Commit your changes (git commit -am 'Added some feature')
  4. Push to the branch (git push origin my-new-feature)
  5. Create new Pull Request

The development requires TypeScript and AWS CDK

  1. npm install -g typescript ts-node aws-cdk
  1. git clone https://github.com/SSHcom/privx-on-aws
  2. cd privx-on-aws
  4. npm install
  5. npm run build
  6. npm run test
  7. npm run lint

License

See LICENSE