Auditing enterprise-level user permissions used to take hours…now it takes minutes

We reduced auditing and troubleshooting times by 80% (from hours to minutes) by replacing a single-page auditing workflow with a contextual integrated widget, surfacing data where admins naturally look for it.

80% faster audit times

vs original audit workflow

Balanced page traffic

normalizing engagement across every resource page in the console.

Business

AWS | Cloud Computing

Timeline

3 months - Q4 2024 launch

Tools

Figma, Figjam, Asana, UserTesting

Team & Collaborators

1 Product Manager, 2 Engineering teams

Learn More

AWS Documentation

As the UX designer I was responsible for

Taking over design and PM responsibilites for the project from another team member
Iterative wireframe designs across all design permutations
Consistent collaboration with engineering team given technical contraints
Usability testing internally and externally to validate the permission audit mental model

The friction holding back enterprise adoption

Behind only migrating existing permission policies, permission auditing was the single largest barrier to enterprise adoption. For multi-account organizations, answering the basic question of "who has access to what" required days of tedious manual auditing—leaving teams hesitant to roll out the product at scale.

The existing workflow was bottlenecking admins

The original multi-account access audit flow required admins to individually navigate to every account detail page and manually paginate through the user and group assignments - a workflow that was not realistic for anyone to use at scale.

Maria - Enterprise admin (manages 80 AWS accounts)

“I need to see every AWS account Jorge has access to in my organization.”

user flow diagram of the steps required for an admin to audit a users AWS account access

First we updated the UI pattern so it could scale

Using a miller column pattern gave us a way to make this widget modular while also being familiar to users.

Before (Table) After (Column View)

Original interface to view user and group AWS account access

New interface to view user and group AWS account access

Using progressive disclosure allowed and load-on-scroll for the columns allowed for us to use this pattern without any new APIs or technical issues.

Animated interface showing the progression of UI columns opening showing the 'entitlement' data.

Then we made it accessible on each resource page

Once we launched the new widget on the Users, and Groups page - we immediately saw a normalization of our page traffic. This means admins were successfully auditing from the root instead of being forced into a strict workflow.

User Group Account (updated)

Edit Anywhere, Provision Asynchronously

We brought editing capabilities directly to where data lives. Swapping out a rigid wizard for a single page, paired with background async provisioning, means admins can make sweeping bulk edits on the spot without getting stuck waiting on system confirmations.

Some key learnings and reflection

Technical constraints should not get in the way of insisting on the best customer experience, it’s an opportunity to be creative.
Iteration and progressive enhancement is better than waiting for perfection. It’s much better to ship and see how customers are using the design in production and continue to iterate based on their feedback.