Skip to main content

What is Prism?

CloudKeeper Prism is a multi-tenant Identity and Access Management (IAM) platform that centralizes how your organization manages users, groups, permissions, and AWS account access. Prism provides a unified interface for identity governance across your AWS environment.

Portals and Organization Services​

Prism is organized into three surfaces, each serving a different audience and purpose: the Admin Portal, the JIT Access Portal, and Organization Services (which groups CloudTrail and Security Hub). After logging in, you select which to access from the Application Selection screen:

Admin Portal​

The Admin Portal is the central management console for Customer Admins. From here you can:

  • Create and manage users and groups
  • Define permission sets with AWS managed policies or custom inline IAM policies
  • Create assignments that grant users or groups access to specific AWS accounts
  • Onboard and manage AWS accounts in your organization
  • Configure identity providers (Google, Microsoft, or custom OIDC) for single sign-on
  • Set up SCIM provisioning for automatic user and groups synchronization
  • Replicate your IAM Identity Center configuration to Prism
  • View audit logs and access logs
  • Manage API tokens and log export settings

JIT Access Portal​

The JIT (Just-In-Time) Access Portal enables end users to request temporary, time-bound AWS access without permanent standing permissions. Key features include:

  • Request access to AWS accounts using standard or custom permission sets
  • Track request status through the approval workflow
  • View active sessions and their remaining time
  • Approver dashboard for account owners and admins to review, approve, or reject requests
  • Multi-level approval workflow — account owners approve first, then admins (for custom permission set requests only)

Organization Services​

Organization Services lets you manage and monitor AWS services across every account in your organization from a single interface. It provides two services:

CloudTrail​

The CloudTrail provides a centralized interface for managing AWS CloudTrail trails across multiple accounts. Features include:

  • Create trails using a guided 4-step wizard
  • Manage trail configuration — event types, S3 bucket settings, account selection
  • Monitor trail status across your organization
  • Configure management events, data events, insight events, and network activity events

Security Hub​

The Security Hub centralizes cloud security posture management, threat detection, data security, vulnerability management, and security investigation across your AWS organization, deploying six capabilities from one place rather than account by account. Features include:

  • Security Hub CSPM: enroll member accounts under a delegated administrator and evaluate them against up to six AWS compliance standards, with per-standard compliance scores and a control-level drill-down
  • Amazon GuardDuty: enable threat detection across accounts and regions, with a severity-based threat dashboard, per-type and per-account breakdowns, and an archive workflow for triaging findings
  • AWS Config: the recording foundation that Security Hub standards depend on; Prism provisions and manages recorders across enrolled accounts and regions
  • Amazon Macie: S3 data-security posture and sensitive-data findings across your accounts and regions, with a bucket-posture inventory and opt-in automated sensitive-data discovery
  • Amazon Inspector: software vulnerability scanning of EC2 instances, ECR container images, Lambda functions, and code repositories, with an estate-wide Top CVEs view, fix-availability tracking, and selectable scan types; enabled independently in each account with no delegated administrator
  • Amazon Detective: behavior-graph investigation of the IAM users and roles involved in a security event, built from CloudTrail management events, VPC flow logs, and GuardDuty findings; accounts join one administrator's behavior graph by invitation

Security Hub and CloudFormation StackSets are beta capabilities that CloudKeeper enables together for your organization on request.

Key Concepts​

ConceptDescription
RealmAn isolated tenant environment. Each customer organization has its own realm.
Permission SetA collection of AWS IAM policies that define what actions a user can perform.
AssignmentA mapping of a user or group to a permission set on a specific AWS account.
ReplicationThe process of synchronizing your IAM Identity Center configuration to Prism.
JIT AccessJust-In-Time access — temporary, time-bound AWS permissions granted through an approval workflow.
SCIMSystem for Cross-domain Identity Management — a protocol for automatic user and group provisioning.
TrailAn AWS CloudTrail configuration that logs API activity to an S3 bucket.
Security HubA Prism Organization Services capability that centralizes compliance posture (CSPM), threat detection (GuardDuty), data security (Macie), vulnerability management (Inspector), security investigation (Detective), and AWS Config recording across your organization.
Delegated AdministratorThe AWS account designated to receive and aggregate findings from all enrolled member accounts. Used by Security Hub CSPM, GuardDuty, Macie, and Amazon Detective. Amazon Inspector has no delegated administrator, it is enabled independently in each account.
Behavior GraphAmazon Detective's linked model of the activity in your accounts, built from CloudTrail management events, VPC flow logs, and GuardDuty findings. One administrator account owns it, and Detective builds one graph per region.

Role Hierarchy​

Prism uses a four-level role hierarchy:

RoleLevelDescription
Viewer0Can view resources and request JIT access
Approver1Can approve/reject JIT requests for owned accounts
SSO Admin2Full access excluding admin management
Admin3Full access — can manage all platform settings

Each role inherits the permissions of all roles below it. For example, an Approver can do everything a Viewer can, plus approve requests.

Your organization accesses Prism through a dedicated subdomain (e.g., yourcompany.prism.cloudkeeper.com).

Next Steps​