Skip to main content

What is Prism?

CloudKeeper Prism is a multi-tenant Identity and Access Management (IAM) platform that centralizes how your organization manages users, groups, permissions, and AWS account access. Prism provides a unified interface for identity governance across your AWS environment.

Portals and Organization Services​

Prism is organized into three surfaces, each serving a different audience and purpose: the Admin Portal, the JIT Access Portal, and Organization Services (which groups CloudTrail, Security Hub, and CloudFormation StackSets). After logging in, you select which to access from the Application Selection screen:

Admin Portal​

The Admin Portal is the central management console for Customer Admins. From here you can:

  • Create and manage users and groups
  • Define permission sets with AWS managed policies or custom inline IAM policies
  • Create assignments that grant users or groups access to specific AWS accounts
  • Onboard and manage AWS accounts in your organization
  • Configure identity providers (Google, Microsoft, or custom OIDC) for single sign-on
  • Set up SCIM provisioning for automatic user and groups synchronization
  • Replicate your IAM Identity Center configuration to Prism
  • View audit logs and access logs
  • Manage API tokens and log export settings

JIT Access Portal​

The JIT (Just-In-Time) Access Portal enables end users to request temporary, time-bound AWS access without permanent standing permissions. Key features include:

  • Request access to AWS accounts using standard or custom permission sets
  • Track request status through the approval workflow
  • View active sessions and their remaining time
  • Approver dashboard for account owners and admins to review, approve, or reject requests
  • Multi-level approval workflow: account owners approve first, then admins (for custom permission set requests only)

Organization Services​

Organization Services lets you manage and monitor AWS services across every account in your organization from a single interface. It provides three services:

CloudTrail​

The CloudTrail provides a centralized interface for managing AWS CloudTrail trails across multiple accounts. Features include:

  • Create trails using a guided 4-step wizard
  • Manage trail configuration: event types, S3 bucket settings, account selection
  • Monitor trail status across your organization
  • Configure management events, data events, insight events, and network activity events

Security Hub​

The Security Hub deploys nine capabilities across your AWS organization from one place rather than account by account. Eight of them are security capabilities (cloud security posture management, threat detection, data security, vulnerability management, security investigation, access analysis, web application firewall policy, and the AWS Config recording those standards depend on), and the ninth, VPC IPAM, is not a security tool at all: it is organization-wide IP address management, which lives here because it is configured across every account in exactly the same way. Features include:

  • Security Hub CSPM: enroll member accounts under a delegated administrator and evaluate them against up to six AWS compliance standards, with per-standard compliance scores and a control-level drill-down
  • Amazon GuardDuty: enable threat detection across accounts and regions, with a severity-based threat dashboard, per-type and per-account breakdowns, and an archive workflow for triaging findings
  • AWS Config: the recording foundation that Security Hub standards depend on; Prism provisions and manages recorders across enrolled accounts and regions
  • Amazon Macie: S3 data-security posture and sensitive-data findings across your accounts and regions, with a bucket-posture inventory and opt-in automated sensitive-data discovery
  • Amazon Inspector: software vulnerability scanning of EC2 instances, ECR container images, Lambda functions, and code repositories, with an estate-wide Top CVEs view, fix-availability tracking, and selectable scan types; enabled independently in each account with no delegated administrator
  • Amazon Detective: behavior-graph investigation of the IAM users and roles involved in a security event, built from CloudTrail management events, VPC flow logs, and GuardDuty findings; accounts join one administrator's behavior graph by invitation
  • AWS IAM Access Analyzer: external-access analysis of the resource policies in your accounts, plus opt-in unused-access analysis of IAM roles, users, access keys and passwords; enabled independently in each account with no delegated administrator
  • AWS Firewall Manager: organization-wide AWS WAF (WAFv2) web ACL policies, applied and audited by Prism through each account's own switch role, with an orphan scanner for web ACLs left behind by a removed policy
  • VPC IPAM: organization-wide IP address management, with a discovered inventory of every VPC, subnet and Elastic IP CIDR across your enrolled accounts, address pools you allocate from, utilization, and cross-account CIDR overlap detection. This is a networking capability, not a security one, and it is the only capability that requires a paid AWS tier (IPAM Advanced)

CloudFormation StackSets​

Deploy one CloudFormation template across the accounts and regions of your organization from a single administration account. Features include:

  • Create StackSets that target organizational units, with one stack instance per account and region
  • Update templates, sync targets as accounts join or leave your OUs, and retry failed instances
  • Delete deployments while choosing whether the underlying stacks are retained or destroyed

Security Hub and CloudFormation StackSets are beta capabilities that CloudKeeper enables together for your organization on request.

Key Concepts​

ConceptDescription
RealmAn isolated tenant environment. Each customer organization has its own realm.
Permission SetA collection of AWS IAM policies that define what actions a user can perform.
AssignmentA mapping of a user or group to a permission set on a specific AWS account.
ReplicationThe process of synchronizing your IAM Identity Center configuration to Prism.
JIT AccessJust-In-Time access: temporary, time-bound AWS permissions granted through an approval workflow.
SCIMSystem for Cross-domain Identity Management: a protocol for automatic user and group provisioning.
TrailAn AWS CloudTrail configuration that logs API activity to an S3 bucket.
Security HubThe Prism Organization Services surface that centralizes compliance posture (CSPM), threat detection (GuardDuty), data security (Macie), vulnerability management (Inspector), security investigation (Detective), access analysis (IAM Access Analyzer), web ACL policy (Firewall Manager), and AWS Config recording across your organization. It also covers VPC IPAM, which is IP address management rather than security.
Delegated AdministratorThe AWS account designated to receive and aggregate findings from all enrolled member accounts. Used by Security Hub CSPM, GuardDuty, Macie, and Amazon Detective. Amazon Inspector, AWS IAM Access Analyzer, AWS Firewall Manager and VPC IPAM have no delegated administrator.
IPAM Host AccountThe AWS account that owns the IPAM resource in VPC IPAM. It is an ordinary enrolled account, not an AWS Organizations delegated administrator, and it is chosen once and cannot be changed afterwards. Because AWS charges the IPAM owner, the host account carries the IPAM bill for every account you enrol.
Resource DiscoveryThe AWS resource that lets VPC IPAM see one account's VPCs, subnets and Elastic IPs. Prism creates one per enrolled account, shares it to the host account with AWS RAM, and associates it to the IPAM. AWS then sweeps it periodically; it is not a live query, which is why a newly enabled IPAM has an empty inventory for a while.
Behavior GraphAmazon Detective's linked model of the activity in your accounts, built from CloudTrail management events, VPC flow logs, and GuardDuty findings. One administrator account owns it, and Detective builds one graph per region.
Zone of TrustThe boundary an AWS IAM Access Analyzer analyzer treats as trusted. Prism creates account-scoped analyzers, whose zone of trust is the single AWS account, so a grant to another account in your own AWS Organization is reported as external access. An organization-scoped analyzer, which requires management-account access that Prism does not hold, would treat it as trusted.

Role Hierarchy​

Prism uses a four-level role hierarchy:

RoleLevelDescription
Viewer0Can view resources and request JIT access
Approver1Can approve/reject JIT requests for owned accounts
SSO Admin2Full access excluding admin management
Admin3Full access: can manage all platform settings

Each role inherits the permissions of all roles below it. For example, an Approver can do everything a Viewer can, plus approve requests.

Your organization accesses Prism through a dedicated subdomain (e.g., yourcompany.prism.cloudkeeper.com).

Next Steps​