Skip to main content

How to give temporary access

When one person needs one extra permission for a limited time, use a direct grant instead of putting them in a group. Grants always expire, which is what keeps temporary access from quietly becoming permanent.

Prerequisites​

  • iam:grant:create to create, iam:grant:renew to extend, iam:grant:revoke to cancel.
  • You can only grant a permission you hold yourself, at the target you are granting on.

Create a grant​

  1. Open IAM and go to the Grants tab.
  2. Click Create grant.
  3. Pick the user and the permission.
  4. Choose the scope and, for customer or VDC, the target.
  5. Set the expiry date. It is mandatory and must be in the future.
  6. Write the reason and confirm.

The permission applies on the user's next token refresh, within about five minutes.

Extend a grant​

If the work is not finished, renew it rather than creating a second grant:

  1. Find the grant in the Grants tab.
  2. Choose Renew and pick the new expiry date.

The new date has to be later than the current one. Renewing to an earlier or equal date is refused — to shorten access, revoke and create it again.

Revoke a grant​

Choose Revoke on the grant. It stops counting immediately, and the record stays visible for auditing. A grant that is already revoked cannot be revoked again.

Notes​

  • Grants expire on their own. There is no need to clean them up afterwards.
  • If several people need the same exception, that is a group, not a set of grants. Grants scattered across users are what makes access impossible to review later.
  • The Permissions tab on a user shows grants merged with group permissions, and marks which is which.