Answer "who can reach production data?" from one screen
Roles scoped to specific resources, with an audit trail that names people, not service accounts.
“For the audit: please export the list of everyone with access to the production S3 buckets, with justification”
What the wait costs
Three weeks of interviews and console screenshots, producing a snapshot that is wrong by the time it is signed.
In Fenwave
Platform Settings›Users & permissions›Roles
Capability
Platform SettingsAccess questions are hard to answer when access is granted by handing out credentials, because the credential is where the trail ends. Fenwave inverts this: the cloud key is stored once and never distributed, and people are granted named roles scoped to named resources. The answer to "who can reach this bucket" is a query against the role model, and the audit log attributes each action to the person who performed it.
How it works
- 01Review roles in Platform Settings; each lists the resources it is scoped to.
- 02Read grants down to a single storage connection or environment.
- 03Cross-check the audit log — every privileged action names a person.
- 04Revoke by removing the role; no credential rotation required.