Start here
Concepts
The words these pages use, and how they relate.
#Shonin org
A company, or a team, on Shonin: its people, groups, permission sets and assignments. Each Shonin org has its own address, https://<name>.app.shonin.ai, and its own administrators. The same email can have an account in several Shonin orgs: each account is separate.
#AWS organization
An organization of AWS Organizations: a management account and its member accounts. A Shonin org can connect more than one AWS organization, and an AWS organization is connected to at most one Shonin org, its owner. The link cannot be changed later.
#Installation
The part of Shonin that runs in the management account of your AWS organization, deployed with a CloudFormation stack named shonin-installation: one for each AWS organization you connect. It signs the tokens AWS accepts, checks the second factor, and creates the roles of your permission sets in your accounts. Shonin cannot reach it from the internet: the installation reads its requests from a queue. See Security.
#Permission set
A name and its AWS managed policies, as in IAM Identity Center. On every account where it is assigned, it becomes an IAM role named shonin-<Shonin org>-<permission set>. See Permission sets and assignments.
#Assignment
A person or a group, a permission set, and an account. A person opens a permission set only on the accounts where it is assigned to them or to one of their groups.
#Delegation
The owner of an AWS organization shares single accounts with another Shonin org, which then assigns its own permission sets on them. The other Shonin org needs no AWS organization, and can be in another company. Delegated accounts cannot be delegated again. See Share accounts with another company.
A Shonin org can use an account if the account is in the AWS organization it owns, or if another Shonin org delegated it.
#Administrators and users
- Administrators manage people, groups, permission sets, assignments, delegations and the AWS organization, and use the Assistant.
- Users see only the accounts and permission sets assigned to them.
Primary admins are administrators who always keep a password and an authenticator app, also with single sign-on on, so the Shonin org stays reachable if your identity provider is unavailable. See Second factor.
#Second factor
A code from an authenticator app, a backup code, or a code by email, asked at sign-in and checked by your installation. With more AWS organizations, one installation checks it for all of them. See Second factor.