Skip to main content

Users & roles

GuardKite supports per-tenant user management. Each user has a role that controls what they can do.

Roles​

Admin — full access to findings, AWS accounts, users, and billing. Can add, edit, and remove users; can promote a member to admin; cannot demote themselves out of the admin role.

Member — read-only access to findings-related data. Can view Findings, IAM Risk, Attack Paths, and Events; cannot add or remove users, manage AWS accounts, or change settings.

Managing users​

Open Settings → Users in the sidebar.

Add a user​

  1. Click Add.
  2. Enter the user's details, choose a role, and click Create.

The user receives an email invitation, valid for two days. They click its link to join your organization, then set a password or continue with Google or Microsoft using the invited address.

Signing in without accepting the invitation first doesn't work: GuardKite has no open sign-up.

Resend an invitation​

If a user's invitation expired before they accepted it, click Resend Invitation to send a new one.

Change a role or remove a user​

  • To change a role, click Edit, pick the new role, and click Update.
  • To remove a user, click Delete and confirm.

Service users​

A service user lets another application read your organization's GuardKite data, for example a partner's integration that shows your findings in its own product. It works without anyone's password and keeps working when people join or leave your team.

  • Read-only. A service user has Member access: it sees everything a Member sees, including findings, AWS accounts, and the user list, and it can't change anything.
  • No sign-in. A service user has no email address and can't sign in to GuardKite. The application uses an API key instead.
  • Admins manage them. Only an Admin can add, change, or remove a service user.

Add a service user​

  1. Open Settings → Users and click Add service user.
  2. Enter a name that says which application it's for, and click Create.
  3. Copy the API key from the dialog and give it to the application's operator.

GuardKite shows the key only once. If it's lost, regenerate it.

Look after the key​

Treat the key like a password: anyone who holds it can read what a Member can read.

  • Share it only with the application that needs it, through a secure channel.
  • If you think it has been exposed, regenerate it right away.
  • Key last used on the service user shows when the application last used the key, so an unused key is easy to spot.

Regenerate, disable, or remove​

Open the service user in Settings → Users.

  • Regenerate key issues a new key. The old key stops working immediately, so update the application with the new one.
  • Disable by setting Status to Inactive and clicking Update. The key stops working immediately. To enable the service user again, set it back to Active and regenerate the key, since the old key doesn't come back.
  • Delete removes the service user. Its key stops working immediately.