Agent WranglersAudit logs and access Required
Grant admin rights only for a set time
Give nobody standing admin rights to production. Grant them on request, with a reason, for at most 8 hours, and log every grant.
How to do it
Set up the grants as grant admin access for hours only describes, and the emergency accounts as in keep tested break-glass accounts. Cover databases, the admin tool and the code host too, not only the cloud. A second person approves grants for production data. Export every grant each quarter as evidence. ISO/IEC 27001:2022 control A.8.2 covers privileged access.
How to check
A query of the cloud and database roles finds no person with a permanent admin role, except the emergency accounts. Every grant in the last quarter has a reason, an approver and an end time within 8 hours.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/just-in-time-admin.