Temporary Machines

Temporary machines are time-bounded identities workloads that should end on a known date. You choose the lifetime and optional connection guardrails before issuing the machine, then approve it and grant only the projects and secrets it needs.

#How temporary machines work

The machine lifetime begins when the bootstrap command is successfully redeemed, so the full configured duration is available from registration time.

#Create a temporary machine

A temporary machine lifetime must be at least 1 hour and no more than 12 months. The creation screen shows the resulting duration and expected expiration date before you continue.

#Configure guardrails

Guardrails restrict where and when the temporary machine may authenticate. Each guardrail is optional. When several are enabled, the request must satisfy all of them.

Time Window

Use a time window to permit requests only during selected hours and days.

• Choose a start and end time.

• Select the timezone used to interpret those times.

• Choose one or more permitted days of the week.

• For a window that crosses midnight, set a start later than the end and include every day on which requests should be accepted.

IP Allowlist

Use the temporary-machine IP Allowlist to restrict requests to specific source addresses or network ranges.

• Enter one IPv4 or IPv6 address or CIDR range per line.

• An individual address permits one source host.

• A CIDR range permits every source address within that network.

• For hosts behind NAT, a gateway, or a proxy, enter the public egress address that SikkerKey receives.

Geo

Use Geo to permit requests only when the source IP resolves to one of the selected countries. Search by country name or two-letter country code, then select every permitted country.

How guardrails combine

Temporary-machine guardrails add to the rest of the access path. A request must also satisfy the vault IP Allowlist, project membership, the explicit secret grant, and any access policy attached to the secret.

#Generate and run the bootstrap command

The bootstrap command is single-use and remains valid for 7 days. The wizard shows the exact token expiration time, and the copied command is cleared from the clipboard after 30 seconds.

• Linux and macOS require curl and OpenSSL.

• Windows requires OpenSSL in PATH and uses the PowerShell command shown by the wizard.

• The configured machine name is applied during registration.

Identity files

Bootstrap creates a private key and public key on the target host. Only the public key is registered with SikkerKey; the private key remains on the host and signs future requests.

• Linux and macOS store the identity under ~/.sikkerkey/vaults/{vaultId}/.

• Windows stores it under %USERPROFILE%\.sikkerkey\vaults\{vaultId}\.

#Approve the temporary machine

Registration creates a pending machine. Pending machines cannot read secrets, even when the bootstrap command was issued by an authorized vault member.

The lifetime continues to count down while the machine is pending, so approve and configure it promptly.

#Add project and secret access

Approval activates the identity but does not grant any secret access.

Project membership and secret grants can be updated throughout the machine’s active lifetime. Removing the machine from a project immediately removes all of its grants in that project. Clearing an individual secret grant removes only that secret’s access.

#Recognize temporary machines in the dashboard

Temporary machines appear in All Machines with an hourglass icon. Hover over the icon to see when the machine expires.

Search by name and filter by status, project, last-seen period, or registration date. The Default filter shows pending and active machines. Select All or Disabled to review identities outside the default working set.

#Extend the lifetime

Extend an active temporary machine when approved work needs more time.

An extension moves the expiration forward. The resulting expiration may be no more than 12 months from the time you extend it. Extend the machine before its current lifetime ends.

#Review and revert extensions

Only the most recent extension that still applies can be reverted. Reversion is available only while the previous expiration remains in the future.

The Names tab records renames, and the Audit tab shows the complete machine activity timeline with action, severity, time, and text filters.

#Disable, enable, or revoke

Disable

Disable immediately blocks authenticated requests while preserving the machine identity, project memberships, grants, guardrails, and expiration. The lifetime continues to count down while disabled.

Enable

Enable resumes access for a disabled temporary machine when its expiration is still in the future. The existing grants and guardrails continue to apply.

Revoke

Revoke immediately removes the machine registration, all project memberships, and every secret grant. The identity stored on the host can no longer authenticate.

Use revoke when the engagement finishes early, the host is lost, or its private key may be exposed.

#Expiration and cleanup

At the configured expiration time, SikkerKey rejects further authentication and marks the temporary machine expired. Expired machines remain available for review during a 30-day retention period.

#Control access to temporary machines

Vault owners receive full machine access. Organization members receive these permissions through their vault role and project access.

#Review temporary-machine activity

SikkerKey records the temporary-machine lifecycle in the Audit Log, including:

• temporary-machine command creation and registration;

• approval, denial, rename, disable, enable, and revocation;

• lifetime extensions and extension reversions;

• project additions, removals, and secret grant changes;

• successful, denied, and policy-blocked secret reads;

• authentication and guardrail failures; and

• automatic expiration and cleanup after retention.

Open History → Audit from the machine row to focus the Audit Log on one temporary machine.

#Troubleshoot temporary-machine access