Raff IAM controls who can do what across your account: built-in and custom roles with a named permission for every action, project-scoped access, API keys with roles and expiry, MFA, and a full audit trail. Included free, no policy JSON required.
On the big clouds, giving a teammate console access means writing policy documents in JSON and debugging them in production. On Raff, it's a role and a set of toggles.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["ec2:RunInstances",
"ec2:GetConsole*"],
"Resource": "*",
"Condition": { "...": "..." }
}]
}One wrong wildcard and your intern can delete production. One missing action and the deploy fails at 2 AM.
Three levels you can hold in your head. Account owners and admins see everything; everyone else sees exactly the projects they were given.
Your organization. Members join by email invitation with a role attached: Owner, Admin, Billing, Member, or one you built.
Resources live in projects, and project access is separate from account membership. A contractor in one project sees nothing else.
Every action on every resource maps to a named permission: vm.console, backup.restore, databases.connect. Grant exactly what you mean.
Start with the built-ins. When your team outgrows them, create custom roles by toggling exactly the permissions you mean, from the dashboard or the API.
Raff IAM includes a named permission for every action, across account and project scopes, free with every account. The full catalog is one API call: GET /v1/permissions.
No god-mode tokens. Keys join the member system with a role, a scope and an optional expiry, and every call they make lands in the audit log.
An API key holds a role, exactly like a person. Your CI pipeline gets deploy permissions and nothing else.
Set an expiry date on any key. The quarterly contractor key stops working when the contract does.
Standard or high rate limits per key, so one runaway script cannot starve the rest of your automation.
Keys are displayed a single time at creation and stored as salted hashes. Nobody can read them back, including us.
Access control without records is a promise, not a control. Raff logs every action in your account and shows it to you in the dashboard.
Visible to Owners and Admins under Security in your dashboard, gated by the account.audit.view permission.
IAM is on for every account from the first sign-up. There is nothing to enable and nothing to pay for.
Send an invitation with a role attached. Pending members cost nothing and expire if unclaimed.
Add members to the projects they work on. Everyone else stays out by default, not by convention.
Every action lands in the log from day one. Review grants, denials and API key activity anytime.
One set of roles and one audit log across the whole platform. Everything below answers to Raff IAM.
IAM controls who can do what in your cloud account. On Raff that means roles with a named permission for every action, project-scoped access, API keys with roles, MFA and an audit log, included free with every account.
Nothing. Unlimited members, unlimited custom roles, API keys, MFA and the audit log are included free on every Raff account.
Yes. Start from 8 built-in roles or build your own by toggling exactly the permissions you mean, like vm.create or backup.restore, in the dashboard or via the API.
Resources live in projects, and project access is separate from account membership. Account Owners and Admins see everything; everyone else sees only the projects they were explicitly added to.
Yes. On Raff, API keys are members: each key holds a role, can be scoped to projects, and can carry an expiry date. Your CI key deploys and does nothing else.
No policy JSON. Raff uses named roles and permission toggles instead of policy documents, so access takes a minute to grant and is hard to get wrong. AWS IAM is more granular but far more complex.
Yes. Authenticator-app MFA (TOTP) is built into every Raff account and enforced at sign-in once enabled. Enrollment takes a QR scan and one 6-digit code.
Roles, projects, API keys and a full audit trail, free with every account. 15,000+ builders run on Raff from Vint Hill, Virginia, backed by a 99.9% uptime SLA in writing.