A Self-Service Control Plane for AWS Permissions

Managing AWS permissions across a growing number of accounts quickly becomes a bottleneck. At Netflix, the Cloud Infrastructure Security team was overwhelmed with requests for access and policy changes — every request meant hand-crafting IAM policies, logging into multiple accounts, and iterating with the user through trial and error until things worked. That model doesn’t scale.

To address this, Netflix open sourced ConsoleMe (pronounced kuhn-soul-mee) at AWS re:Invent 2020, along with its CLI companion, Weep. ConsoleMe is a self-service tool that centralizes and automates permissions and access management across multiple AWS accounts, shifting the security team from gatekeepers to enablers.

Core Features for Users and Administrators

ConsoleMe gives end users a unified portal for day-to-day AWS access and permissions tasks. Administrators get a central management plane that removes the need to hop between AWS accounts.

Simplified Console Access and Credential Retrieval

Users can access the AWS console via temporary IAM role credentials. Once a user authenticates, ConsoleMe determines which roles they can access based on identity and group membership. Authorizations can come from role tags, ConsoleMe’s Dynamic Configuration, or custom organizational logic.

Users can log in by clicking a role in the web interface or by crafting URLs that deep-link to a specific role, region, service, or resource. At Netflix, some users even integrated ConsoleMe with tools like Alfred, chat bots, and custom browser search engines.

For CLI users, Weep acts as ConsoleMe’s local agent. It retrieves temporary (one-hour) AWS credentials and supports multiple serving methods:

  • Write credentials to ~/.aws/credentials
  • Export credentials as environment variables
  • Emulate the EC2 instance metadata proxy
  • Emulate the ECS credential provider
  • Generate credential_process commands

Weep can automatically refresh credentials, which is critical for long-running operations like an s3:GetObject that exceeds the one-hour expiry. It can also perform nested AssumeRole calls transparently. The AWS CLI and SDKs discover these credentials through the default credential provider chain, so no extra SDK configuration is required.

Self-Service IAM Requests

The standout feature is a step-by-step wizard for requesting permissions. Users don’t need to understand IAM JSON syntax — they can search for a role and select needed permissions, and ConsoleMe generates the IAM policy and any required cross-account resource policies. Users can review, adjust, and submit the policy for approval.

The wizard is configurable to an organization’s common requests and includes typeahead search across all known AWS permissions and resource ARNs. Low-risk requests can be approved automatically, governed by configuration and powered by the Zelkova automated reasoning service.

For more advanced requests, ConsoleMe includes native policy editors for popular resource types. These editors provide:

  • Direct management of resource policies and tags by administrators
  • End-user policy manipulation with approval workflows
  • Typeahead for AWS permissions and known resources
  • Policy templates for consistent inline policy generation
  • Visibility into recent CloudTrail errors for the specific resource

Currently, ConsoleMe supports only a handful of resource types natively; Netflix encourages community contributions to expand that list via GitHub pull requests.

Finding Resources Across Accounts

ConsoleMe maintains a centralized, filterable inventory of critical cloud resources, synchronized from AWS Config. This gives users a single search surface across every account. For resource types without a native editor, ConsoleMe provides a link that logs the user into the AWS console and navigates directly to the resource.

Role Replication for Administrators

For IAM administrators, ConsoleMe simplifies publishing roles across accounts. Roles can be created from scratch or cloned from existing ones, copying any combination of:

  • Trust policies
  • Descriptions
  • Inline policies
  • Managed policies
  • Tags

That eliminates the manual copy-paste between AWS console sessions.

Enforcing Least Privilege

ConsoleMe promotes least privilege through structural choices. Netflix relies on IAM roles rather than IAM users, since roles avoid long-lived static credentials. Additionally, inline policies are favored over managed policies because they are attached to exactly one role — removing access doesn’t risk breaking other roles that might share a managed policy.

ConsoleMe is meant to operate alongside Netflix’s other open source tool, RepoKid. RepoKid strips unused permissions from roles; when a user eventually needs one of those removed permissions again, ConsoleMe’s self-service wizard makes the request as simple as possible.

Trying ConsoleMe

ConsoleMe is open source and hosted on GitHub. A Docker-based quick start guide is the fastest way to kick the tires, and the repo includes example Terraform configurations to reference when you're ready to deploy it yourself.

Getting Involved

The project has an active roadmap and the maintainers are looking for contributors — not just coders. The open issues list is the place to find work, and non-technical help is equally welcome: the documentation can always use proofreading and clarification to make the tooling more approachable for new users. The contributing guide covers how to get started.

Netflix is also hiring for the security team working on these problems.

On the Roadmap

ConsoleMe has been battle-tested internally at Netflix over the past few years, and the open-source version reflects that maturity. The project's future plans focus on tackling some of the hardest remaining problems in large-scale cloud permissions management.

Simpler Permission Debugging

AWS access-denied errors are notoriously opaque. The team wants to make it possible to ask ConsoleMe whether a given IAM role can take a specific action on a resource — and if not, get an explanation that accounts for the policy layer causing the block. Relevant context would be pulled together from:

  • CloudTrail logs
  • Service control policies
  • Resource policies
  • Permission boundaries
  • Session policies
  • Inline policies
  • Managed policies

Team Role Support

Planned features would streamline managing team roles: IAM roles shared by an entire team, which can be propagated across accounts with different permissions in each one. The goal is a simplified interface for creating, requesting, and modifying such roles.

Better Cross-Account Policy Generation

ConsoleMe currently generates cross-account policies for only a subset of resource types. Expansion plans include broader resource coverage and making generated policies context-aware of permission boundaries and service control policies for greater accuracy.

Decentralized Policy Requests

Cloud administrators shouldn't have to review every policy request. Where ConsoleMe understands resource ownership and can see that a request falls within defined safety limits, it should route the request straight to the affected resource owners.

Policy Rollback

When a policy change breaks an IAM role or blocks new functionality, administrators need a way back. The roadmap includes letting users revert a role to an earlier snapshot.

Multi-Cloud

Longer term, the project aims to manage access and permissions centrally across cloud providers, not just AWS.

More Information

Netflix credits Srinath Kuruvadi, Jay Dhulia, the Cloud Infrastructure Security and Infosec teams, and AWS partners, along with the external contributors to both ConsoleMe and Weep.