Grants temporary production server access with a strict 60-minute countdown timer, verifies that the engineer is on-call in PagerDuty, collects one-click manager approval in Slack, and automatically revokes access the second the timer expires.
// Checked in under 5ms before granting temporary server access
rule temporary_access_gate {
match:
request.action == "bastion_ssh" &&
actor.is_oncall == true &&
target.cluster in ["prod-db-cluster", "prod-k8s-control"]
allow:
teleport.grant_role(role: "prod_db_readonly", ttl: "60m") &&
audit.record_session(format: "tamper_proof_log")
action:
require_manager_approval(
approver_role: "engineering_manager",
channel: "#it-access-requests",
approval_type: "tamper_proof_single_use"
)
}