How PicPay achieved temporary elevated access control on AWS
summary
PicPay implements AWS TEAM for just‑in‑time elevated access across 200+ AWS accounts and 2,000+ cloud users, gating production changes behind strict SCPs and Active Directory group‑based request/approval flows where BU managers grant time‑bound sessions limited to 4 hours. Long‑term access remains in permission sets via AWS Identity Center/SSO, every action logs to CloudTrail, and the result is auditable, reversible production changes, faster incident triage and measurable MTTR reduction.
AI-written summary · about
chapters (5)
- 0:00Introduction and background
- 0:44Company overview
- 2:04Scaling and challenges
- 3:19Access control implementation
- 11:29Closing remarks
related talks
15mSupplement your AWS security with JIT access and CNAPP
17mManage temporary elevated access with AWS IAM Identity Center
44mAchieve your identity, security, and compliance goals on
57mEstablishing a data perimeter on AWS
26mThe Power of AWS Tags (Advanced IAM Session)
53mAchieving End-to-end Security on AWS
45mSecurity Lessons Learned Moving a Bank 100% in the Cloud
44mGuardrails in the Cloud