--- title: Granular and Seamless Just-in-Time (JIT) Access with... description: Teleport 10 introduces Resource Access Requests, letting engineers request just-in-time access to specific infrastructure resources (servers, Kubernetes... canonical: https://daily.dev/posts/granular-and-seamless-just-in-time-jit-access-with-teleport-i2xeosmtq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Granular and Seamless Just-in-Time (JIT) Access with Teleport | daily.dev og:description: Teleport 10 introduces Resource Access Requests, letting engineers request just-in-time access to specific infrastructure resources (servers, Kubernetes... og:url: https://daily.dev/posts/granular-and-seamless-just-in-time-jit-access-with-teleport-i2xeosmtq og:image: https://api.daily.dev/og/posts/I2XeOsmtq.png og:image:alt: Granular and Seamless Just-in-Time (JIT) Access with Teleport og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Granular and Seamless Just-in-Time (JIT) Access with Teleport **[Teleport](https://daily.dev/sources/teleport)** · 8 min read · 0 upvotes · 0 comments ## Summary Teleport 10 introduces Resource Access Requests, letting engineers request just-in-time access to specific infrastructure resources (servers, Kubernetes clusters, etc.) rather than roles. Combined with the existing role-based Access Request feature, it offers short-lived scoped certificates, avoids blanket roles, reduces role fatigue via pre-authorized roles, and integrates with Slack/Mattermost for approval workflows. Includes CLI examples for tsh and tctl commands to request, search, and approve access. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Resource Access Request feature in Teleport 10? Resource Access Request is a Teleport 10 feature that lets users request just-in-time access to specific infrastructure resources, such as SSH servers or Kubernetes clusters, instead of requesting entire roles. Users can search available resources with tsh request search and create requests with tsh request create, and administrators approve or deny via Slack, Mattermost, or the Teleport Web UI. _daily.dev surfaces updates like this for teams tightening infrastructure access policies._ ### How do you request access to a role in Teleport using tsh? Run tsh login with the --request-roles flag naming the role and --request-reason explaining why, for example: tsh login --request-roles="kube-member" --request-reason="Need access to Kubernetes cluster for debugging". An administrator then reviews the request and approves it with tctl request approve, specifying the roles and a reason, or via the Teleport Web UI. _teams standardizing on ephemeral access workflows can track tooling changes like this via daily.dev._ ### How can I set a short session TTL for a Teleport role? Set max_session_ttl in the role configuration file, for example max_session_ttl: 1h to issue certificates that expire after one hour. Short-lived, scoped certificates are central to Teleport's just-in-time access model, reducing the risk of long-lived standing privileges being misused after they are no longer needed. _engineers hardening least-privilege access setups can follow tooling updates like this on daily.dev._ ## Similar posts on daily.dev - [Beyond IAM: Temporary Cloud Access That Works Across AWS and Azure](https://daily.dev/posts/beyond-iam-temporary-cloud-access-that-works-across-aws-and-azure-bz1gxdp1l) · AWS Fundamentals · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/granular-and-seamless-just-in-time-jit-access-with-teleport-i2xeosmtq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Granular and Seamless Just-in-Time (JIT) Access with Teleport","url":"https://daily.dev/posts/granular-and-seamless-just-in-time-jit-access-with-teleport-i2xeosmtq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/granular-and-seamless-just-in-time-jit-access-with-teleport-i2xeosmtq"},"datePublished":"2026-08-23T12:22:05.202Z","dateModified":"2026-08-23T12:49:03.063Z","description":"Teleport 10 introduces Resource Access Requests, letting engineers request just-in-time access to specific infrastructure resources (servers, Kubernetes...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/granular-and-seamless-just-in-time-jit-access-with-teleport-i2xeosmtq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Granular and Seamless Just-in-Time (JIT) Access with Teleport"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/granular-and-seamless-just-in-time-jit-access-with-teleport-i2xeosmtq#faq","mainEntity":[{"@type":"Question","name":"What is the Resource Access Request feature in Teleport 10?","acceptedAnswer":{"@type":"Answer","text":"Resource Access Request is a Teleport 10 feature that lets users request just-in-time access to specific infrastructure resources, such as SSH servers or Kubernetes clusters, instead of requesting entire roles. Users can search available resources with tsh request search and create requests with tsh request create, and administrators approve or deny via Slack, Mattermost, or the Teleport Web UI. daily.dev surfaces updates like this for teams tightening infrastructure access policies."}},{"@type":"Question","name":"How do you request access to a role in Teleport using tsh?","acceptedAnswer":{"@type":"Answer","text":"Run tsh login with the --request-roles flag naming the role and --request-reason explaining why, for example: tsh login --request-roles=\"kube-member\" --request-reason=\"Need access to Kubernetes cluster for debugging\". An administrator then reviews the request and approves it with tctl request approve, specifying the roles and a reason, or via the Teleport Web UI. teams standardizing on ephemeral access workflows can track tooling changes like this via daily.dev."}},{"@type":"Question","name":"How can I set a short session TTL for a Teleport role?","acceptedAnswer":{"@type":"Answer","text":"Set max_session_ttl in the role configuration file, for example max_session_ttl: 1h to issue certificates that expire after one hour. Short-lived, scoped certificates are central to Teleport's just-in-time access model, reducing the risk of long-lived standing privileges being misused after they are no longer needed. engineers hardening least-privilege access setups can follow tooling updates like this on daily.dev."}}]} ```