Cloudanix Agentic JIT — GitHub Action

GitHub Actions for integrating Cloudanix Agentic Just-In-Time (JIT) access into your workflows.

Overview

This repository provides two composite actions that bracket your privileged work:

Action	Path	Purpose
Elevate	cloudanix/agentic-jit-action/elevate@v1	POST /v2/agentic/jit — create session, poll until granted
Revoke	cloudanix/agentic-jit-action/revoke@v1	DELETE /v2/agentic/jit/:id — revoke session when done

The actions make only Cloudanix API calls — no cloud SDK, no AWS/GCP/Azure CLI. What you do with the granted access is entirely up to your workflow.

Requirements

• A Cloudanix account with a registered agent (Settings → Agentic JIT → Register Agent)
• The following repository secrets (Settings → Secrets and variables → Actions):

Secret	Description
CLOUDANIX_AUTH_TOKEN	Cloudanix API bearer token
CLOUDANIX_AGENT_IDENTIFIER	Registered agent asset_id_string

Usage

jobs:
  privileged-job:
    runs-on: ubuntu-latest
    steps:
      - name: Elevate JIT access
        uses: cloudanix/agentic-jit-action/elevate@v1
        with:
          auth_token: ${{ secrets.CLOUDANIX_AUTH_TOKEN }}
          agent_identifier: ${{ secrets.CLOUDANIX_AGENT_IDENTIFIER }}

      # Your privileged steps go here.
      # JIT_UNIQUE_IDENTIFIER is available in all subsequent steps.
      - name: Run privileged operations
        run: |
          echo "JIT session: $JIT_UNIQUE_IDENTIFIER"
          # your cloud operations here

      - name: Revoke JIT access
        if: always()
        uses: cloudanix/agentic-jit-action/revoke@v1
        with:
          auth_token: ${{ secrets.CLOUDANIX_AUTH_TOKEN }}

The if: always() on the revoke step ensures the session is revoked even if earlier steps fail.

Inputs

Elevate action (elevate/action.yml)

Input	Required	Default	Description
auth_token	✅	—	Cloudanix Authorization Token
agent_identifier	✅	—	Registered agent asset_id_string
polling_interval	❌	10	Seconds between status-poll requests
max_polling_duration	❌	300	Max seconds to wait for elevation before failing
debug_mode	❌	false	Enable verbose debug logging

Revoke action (revoke/action.yml)

Input	Required	Default	Description
auth_token	✅	—	Cloudanix Authorization Token
session_id	❌	auto from elevate	Session ID to revoke — automatically picked up from the elevate step via JIT_UNIQUE_IDENTIFIER
polling_interval	❌	10	Seconds between status-poll requests
debug_mode	❌	false	Enable verbose debug logging

Outputs

Elevate action

Output	Description
session_id	JIT session identifier — also exported as JIT_UNIQUE_IDENTIFIER in GITHUB_ENV for all subsequent steps

Troubleshooting

• Authentication Errors: Ensure CLOUDANIX_AUTH_TOKEN and CLOUDANIX_AGENT_IDENTIFIER are set as repository secrets and the token has not expired.
• Elevation Timeout: Check that the agent is registered and active in the Cloudanix console. Increase max_polling_duration if your approval workflow takes longer than 5 minutes.
• Session Not Revoked: Always use if: always() on the revoke step. Sessions also auto-expire based on the max_duration configured on the agent registration.

License

Apache License 2.0 — see LICENSE for details.