How to manage cloud access for a small team (no VPN, no enterprise PAM)
To manage cloud access on a small team, give each person their own identity, grant least privilege, hand out access to sensitive systems per task so it expires on its own, and watch what sessions actually do. That covers most of the real risk without a VPN or an enterprise PAM platform, both of which assume a scale and a team you probably don’t have yet.
The small-team bind
Almost every small team lands in one of two spots, and both hurt. Either everyone has admin, which is fast until a tired engineer or a stolen key does something destructive, or one person approves everything and becomes the bottleneck the whole team waits on. Neither is really access control. They’re two ways of coping, and we went deeper on the tradeoff in should developers have access to production.
You don’t need enterprise tooling to do better. A few defaults, set correctly, cover most of it.
A VPN is not access control
A common first move is to put everything behind a VPN and call it done. A VPN decides what network you’re on. It says nothing about what you can do once you’re inside the cloud account. Someone on the VPN with broad permissions can still delete production; someone off it with scoped, expiring access is far safer.
Treat the VPN as a perimeter if you want one, but don’t mistake it for controlling access. The access problem is about identities and permissions, not networks.
What a small team actually needs
Four defaults get you most of the way, and none require a platform team.
Give everyone their own identity instead of shared logins, so actions are attributable. Grant least privilege, read-only by default, since people need to look far more than they need to change. Hand out access to sensitive systems per task so it expires, which removes the standing keys nobody remembers granting. And watch what sessions do, so a destructive action gets caught even when the permission technically allowed it.
Start with what your cloud gives you. AWS IAM Identity Center and equivalents cover the identity and permissions part for free. Add a lighter layer only where the native tools stop, which is usually at expiring access and at watching live actions.
Do you need PAM for this?
Probably not the enterprise kind. A full PAM platform is built for scale and compliance a small team doesn’t have yet. The parts of it that matter, access that expires and oversight on risky actions, you can get without the weight of the whole suite.
Where Korvalis fits
Korvalis is the lightweight layer for exactly this. It hands out access that expires on its own and watches live sessions, cutting off a destructive one before the command finishes, whether it’s an engineer, a stolen key, a contractor, or an AI agent. No VPN to run, no proxy for your team to route through, and no security hire required. It installs inside your own cloud account and starts in observe mode, so you see what it would have caught before it acts.
Frequently asked questions
Do you need a VPN to control cloud access? No. A VPN controls what network you’re on, not what you can do in the cloud account. Manage access with identities, scoped permissions, and expiring grants instead.
What’s the simplest setup for a startup? Individual accounts, read-only by default with write access per task, credentials that expire on their own, and alerts on destructive actions.
How do you control who can access production? Stop handing out standing access. Grant it on request, scoped and expiring, and watch what a session does once it’s in.
If you want cloud access handled without a VPN or enterprise PAM, see how Korvalis works or join the waitlist.