Using Multiple Approval Steps

In this guide, you'll learn how you can configure a Grant Kit to have multiple review steps. Each step will contain a list of reviewers required to approve or deny an access request.

We will be using the Using a Single Approval Step as a base and modify it to this use case.

Step 1. Add Another Workflow Step

Add another step to our workflow, but this time add an additional reviewer

main.tf

resource "abbey_grant_kit" "null_grant" {
  ...

  workflow = {
    steps = [
      {
        reviewers = {
          one_of = ["[e-mail]"]
        }
-      }
+      },
+      {
+        reviewers = {
+          one_of = ["[e-mail]", "[e-mail]"]
+        }
+      }
    ]
  }

  ...
}

We now have a workflow with two steps. These steps will run serially.

First, Alice will be notified to review. If she approves, Bob and Carol will be notified to review. If Alice denies the request, then the access request overall will be denied. Bob and Carol wouldn't be notified at all in this scenario.

Second, Bob and Carol are requested to review. Either of them may approve the request because of the one_of constraint was configured. Further, if Bob approved and Carol hasn't responded, the overall step will be considered approved.

Step 2: Add Another, Stricter Workflow Step

Add another workflow step and have a stricter constraint for reviewers.

main.tf

resource "abbey_grant_kit" "null_grant" {
  ...

  workflow = {
    steps = [
      {
        reviewers = {
          one_of = ["[e-mail]"]
        }
      }
      },
      {
        reviewers = {
          one_of = ["[e-mail]", "[e-mail]"]
        }
-      }
+      },
+      {
+        reviewers = {
+          all_of = ["[e-mail]", "[e-mail]", "[e-mail]"]
+        }
+      }
    ]
  }

  ...
}

We now have a 3 step workflow. The last step requires all reviewers in the list to review.

If one of these reviewers deny the request, then the overall request will be denied. If less than all reviewers approve, then the step will wait until everyone approves.

By default, Abbey waits for 1 week for pending access requests before automatically denying them. This is to reduce access request debt and ensure you have more tidy access management.