Reference

FAQ

Short answers, with links to the pages that explain more.

Who can open my AWS accounts if Shonin is compromised? Nobody without the second factor of a user. The tokens AWS accepts are signed by your installation, with a KMS key in your AWS account, after it checks the second factor itself.

Where are my users? In Shonin: people, groups, roles and assignments. With single sign-on, people sign in with your directory (Google Workspace), and Shonin keeps invitations, roles and assignments.

What runs in my AWS account? The Shonin installation, in your management account: a container, a KMS signing key, a private state bucket encrypted with a key of the installation, and the roles of your permission sets in the accounts you assign. It has no inbound network access.

What does the second factor protect? The console, Access keys and the command line. It is asked at sign-in and lasts 8 hours. See Second factor.

Can I turn off automatic updates? Yes: in Org settings, panel Updates, or with the AutomaticUpdates parameter of the stack. The installation applies only updates signed by Polarity.

How do I stop all sign-ins to my AWS accounts at once? Disable the signing key of the installation in AWS KMS: console sign-in and new credentials stop at once.

Can I connect more than one AWS organization? Yes: a primary admin adds each one from the panel AWS organization, with its own installation. You keep one authenticator app. See Connect your AWS organization.

Can I share an account with a partner? Yes, with a delegation to their Shonin org: see Getting started, step 4.

Which identity providers are supported? Google Workspace. Microsoft Entra ID and Okta come next.

Can people outside my domains sign in when single sign-on is on? Only if Org settings allow a password outside your domains. Otherwise, share the accounts with their own Shonin org.

Can an administrator on a delegated account remove the access of other Shonin orgs? Yes. An administrator permission set makes them an administrator of that account, as in IAM Identity Center: they could delete the roles of other Shonin orgs there. If it happens, the owner ends their delegation, and a new assignment creates the roles again. To a supplier that only needs to read, give a read-only permission set.

How does Shonin compare with AWS IAM Identity Center? The same people, groups, permission sets and assignments, plus delegations of single accounts to other Shonin orgs, also in other AWS organizations, and tokens signed in your own AWS account. See Concepts.

Can I see who opened which account? In AWS CloudTrail of that account: the session is named with the email of the person. See Console access.