Free · built into every account

Identity and access management, down to the permission.

Raff IAM controls who can do what across your account: built-in and custom roles with a named permission for every action, project-scoped access, API keys with roles and expiry, MFA, and a full audit trail. Included free, no policy JSON required.

Unlimited members and rolesEvery action audit-logged
iam · custom role: deploy-engineerrole active
permissions · 4 granted
vm.create
vm.console
backup.restore
databases.connect
account.billing.manage
account.members.remove
[email protected] invited · role: deploy-engineer
audit: role.assign · by you · 10.0.4.2 · success
The problem

Access control shouldn't require a policy compiler.

On the big clouds, giving a teammate console access means writing policy documents in JSON and debugging them in production. On Raff, it's a role and a set of toggles.

Elsewhere · the policy document
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ec2:RunInstances",
      "ec2:GetConsole*"],
    "Resource": "*",
    "Condition": { "...": "..." }
  }]
}

One wrong wildcard and your intern can delete production. One missing action and the deploy fails at 2 AM.

On Raff · a role and four toggles
Pick a built-in role, or make your own
8 built-in roles, custom roles in the dashboard
Toggle the permissions you mean
Named permissions like vm.create and backup.restore
Scope it to a project
Project members see only their project
Done, and audit-logged
Every grant and every action is recorded
The model

Account, project, resource. That's the whole hierarchy.

Three levels you can hold in your head. Account owners and admins see everything; everyone else sees exactly the projects they were given.

Account

Your organization. Members join by email invitation with a role attached: Owner, Admin, Billing, Member, or one you built.

4 built-in roles + custom

Project

Resources live in projects, and project access is separate from account membership. A contractor in one project sees nothing else.

Project Admin · Operator · Member · Viewer

Resource

Every action on every resource maps to a named permission: vm.console, backup.restore, databases.connect. Grant exactly what you mean.

a named permission per action
Roles & permissions

Eight roles ready to use. Or build exactly the one you need.

Start with the built-ins. When your team outgrows them, create custom roles by toggling exactly the permissions you mean, from the dashboard or the API.

Built-in roles
OwnerAccountEverything, including billing and member removal
AdminAccountEverything except ownership transfer
BillingAccountInvoices and payment methods, nothing else
MemberAccountAccess to the projects they are added to
Project AdminProjectFull control inside one project
OperatorProjectDay-to-day ops: power, deploy, restore
MemberProjectWork with resources, no destructive actions
ViewerProjectRead-only visibility
The permission catalog · account + project scopes
Compute
vm.create · vm.console · vm.power · snapshot.restore
Data
backup.restore · databases.connect · objectstorage.upload
Platform
k8s.kubeconfig · functions.deploy · apps.shell
Account
account.members.invite · account.billing.manage · account.audit.view

Raff IAM includes a named permission for every action, across account and project scopes, free with every account. The full catalog is one API call: GET /v1/permissions.

Automation

API keys with the same rules as people.

No god-mode tokens. Keys join the member system with a role, a scope and an optional expiry, and every call they make lands in the audit log.

Keys are members

An API key holds a role, exactly like a person. Your CI pipeline gets deploy permissions and nothing else.

Expiry built in

Set an expiry date on any key. The quarterly contractor key stops working when the contract does.

Rate tiers

Standard or high rate limits per key, so one runaway script cannot starve the rest of your automation.

Shown once, hashed forever

Keys are displayed a single time at creation and stored as salted hashes. Nobody can read them back, including us.

Proof

An audit trail you can hand to your auditor.

Access control without records is a promise, not a control. Raff logs every action in your account and shows it to you in the dashboard.

  • Every API call recorded: who, what, when, from which IP, and whether it succeeded
  • Actor can be a person, an API key or the platform itself, always attributed
  • Denied attempts are logged too, so you see who tried what they should not
  • Per-resource activity tabs on VMs, clusters, databases, apps and functions
  • Authenticator-app MFA (TOTP) for every account, enforced at sign-in
audit log · today
vm.create · [email protected]success
backup.restore · api key ci-deploysuccess
account.billing.manage · [email protected]denied
role.update · yousuccess

Visible to Owners and Admins under Security in your dashboard, gated by the account.audit.view permission.

Getting started

Your team is in before the coffee is cold.

IAM is on for every account from the first sign-up. There is nothing to enable and nothing to pay for.

01

Invite by email

Send an invitation with a role attached. Pending members cost nothing and expire if unclaimed.

02

Scope to projects

Add members to the projects they work on. Everyone else stays out by default, not by convention.

03

Watch the audit log

Every action lands in the log from day one. Review grants, denials and API key activity anytime.

FAQ

Questions teams ask about IAM.

IAM controls who can do what in your cloud account. On Raff that means roles with a named permission for every action, project-scoped access, API keys with roles, MFA and an audit log, included free with every account.

Nothing. Unlimited members, unlimited custom roles, API keys, MFA and the audit log are included free on every Raff account.

Yes. Start from 8 built-in roles or build your own by toggling exactly the permissions you mean, like vm.create or backup.restore, in the dashboard or via the API.

Resources live in projects, and project access is separate from account membership. Account Owners and Admins see everything; everyone else sees only the projects they were explicitly added to.

Yes. On Raff, API keys are members: each key holds a role, can be scoped to projects, and can carry an expiry date. Your CI key deploys and does nothing else.

No policy JSON. Raff uses named roles and permission toggles instead of policy documents, so access takes a minute to grant and is hard to get wrong. AWS IAM is more granular but far more complex.

Yes. Authenticator-app MFA (TOTP) is built into every Raff account and enforced at sign-in once enabled. Enrollment takes a QR scan and one 6-digit code.

Give access, not anxiety.

Roles, projects, API keys and a full audit trail, free with every account. 15,000+ builders run on Raff from Vint Hill, Virginia, backed by a 99.9% uptime SLA in writing.