Skip to main content

Access & Organization Services Users

Organization Services, which hosts CloudTrail, Security Hub, and CloudFormation StackSets, uses a dedicated access model separate from the Admin Portal. This page explains how access is controlled, how to grant it to existing admins, and how to create Organization Services users who can access these services without a full Admin Portal account.

How Access Works​

Access to Security Hub (and CloudTrail) is controlled by a signed services claim embedded in the user's session token. The claim lists which Organization Services the user is permitted to see. The Organization Services sidebar renders only the services present in that claim; if the claim is empty, the sidebar is completely empty.

This means:

  • A user who has not been granted Security Hub access will not see it listed in the sidebar, even if they can log in to Organization Services itself.
  • Access changes take effect after the user signs out and signs back in to receive a new token with the updated claim.
note

The Security Hub and StackSets access toggles only appear in Admin Management once CloudKeeper has enabled the Organization Services beta for your organization. The two are unlocked together by a single beta, there is no separate switch for each. If you do not see these toggles, contact your CloudKeeper representative.

Granting Access to Admin Users​

Admin users can be granted per-service access to Organization Services from the Admin Management area. The step-by-step procedure, including how to locate an admin and toggle CloudTrail or Security Hub access, is documented in Preferences > Admin Management.

The CloudTrail, Security Hub, and StackSets toggles are independent: granting one does not affect the others. CloudTrail is always available, while the Security Hub and StackSets toggles appear only after CloudKeeper enables the Organization Services beta.

Organization Services Users​

Organization Services users are realm users who have access to Organization Services but not the Admin Portal. Use this when you want to give a person access to Security Hub or CloudTrail without granting them admin privileges.

Fields​

FieldDescription
UserThe realm user to add as an Organization Services user. Select from the dropdown of existing realm users.
CloudTrail accessToggle to grant access to CloudTrail.
Security Hub accessToggle to grant access to Security Hub. Appears only when the Organization Services beta is enabled.
StackSets accessToggle to grant access to CloudFormation StackSets. Appears only when the Organization Services beta is enabled.

Adding an Organization Services User​

  1. Navigate to Admin Portal > Preferences > Admin Management.
  2. Scroll to the Organization Services users section.
  3. Click Add Organization Services user.
  4. Select the realm user from the dropdown.
  5. Enable the toggles for the services you want to grant access to (CloudTrail, Security Hub, StackSets, or any combination).
  6. Click Add.

The user can now log in to Organization Services and see the services you enabled.

Revoking Access​

  1. Navigate to Admin Portal > Preferences > Admin Management.
  2. Scroll to the Organization Services users section.
  3. Locate the user in the Organization Services users table.
  4. Click Remove on the user's row.
  5. Confirm the removal.
warning

Revoking Organization Services access does not immediately invalidate an active session. The user loses access when their current token expires and they are required to authenticate again.

Modifying Service Access​

To change which services an Organization Services user can access, remove them and re-add them with the updated toggle selections.

When the Sidebar Is Empty​

If a user can log in to Organization Services but sees a completely empty sidebar, the most likely cause is that no services have been added to their token's services claim: either because access was never granted, or because their token predates the most recent access change.

What to check:

  1. Confirm that an Admin has granted the user access to Security Hub (or CloudTrail) in Preferences > Admin Management.
  2. Ask the user to sign out and sign back in. Organization Services does not automatically refresh the token while a session is active; a new login is required to pick up access changes.
  3. If the user still sees an empty sidebar after signing back in, contact your CloudKeeper representative.

Authentication Required card​

If a user opens Prism without their organization's realm subdomain URL (for example, by navigating to the base domain rather than https://yourcompany.prism.cloudkeeper.com), they may see a static Authentication Required card instead of being redirected to a login page. The fix is to use your organization's realm URL directly.

Enabling Security Hub and StackSets for a Tenant​

Security Hub and CloudFormation StackSets are available as beta features, unlocked together by a single Organization Services beta. CloudKeeper enables it for your organization on request. Contact your CloudKeeper representative to get started. There is no customer-facing UI step to enable the beta itself; once CloudKeeper enables it, both the Security Hub and StackSets access toggles appear in Admin Management and you can proceed to grant access as described above.