mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
105 lines
7.1 KiB
Plaintext
105 lines
7.1 KiB
Plaintext
---
|
||
title: "Overview"
|
||
description: "Learn more and understand the concept of KMS organizations."
|
||
---
|
||
|
||
KMS is structured around organizations and [projects](/documentation/platform/project).
|
||
|
||
## Organizations
|
||
|
||
An organization represents a company or high-level entity (e.g. Acme Corp) and acts as the root scope for managing members and machine identities, projects, usage and billing, global integrations and configuration (such as single sign-on, provisioning, etc), and more.
|
||
|
||
Within an organization, you can create any number of projects—each tied to a specific product type such as Secrets Management or PKI that determines the functionality available.
|
||
|
||
|
||
|
||
## Sub-Organizations
|
||
|
||
Large enterprises may need to create [sub-organizations](/documentation/platform/sub-organizations) to segment by business unit, delegate administration, and maintain clear boundaries between teams. Each sub-organization works like a regular organization with its own projects and settings, while sharing authentication and billing with the root organization.
|
||
|
||
<Info>
|
||
Sub-organizations is a paid feature available under the **Enterprise Tier**.
|
||
</Info>
|
||
|
||
## Projects
|
||
|
||
The _Projects_ tab shows a list of projects that you have access to.
|
||
|
||
If you're an organization admin, you also have the option to view _All Projects_—a complete view of every project within the organization, including those you are not currently a member of— and gain access to any project.
|
||
|
||
Admins can gain access to any project in the organization by opening the options menu (⋮) next to a project and selecting Access. This will add you to the project as an admin and allow full visibility and control.
|
||
|
||
|
||
|
||
## Roles and Access Control
|
||
|
||
The _Access Control_ tab lets you view and manage roles and permissions for users, machine identities, and groups across your organization.
|
||
|
||
Users are invited to an organization and assigned organization-level roles such as `Admin` or `Member`. You can also define [custom roles](/documentation/platform/access-controls/role-based-access-controls#creating-custom-roles) at the organization level to fit your permission model.
|
||
|
||
|
||
|
||
KMS supports [user identities](/documentation/platform/identities/user-identities) (representing people) and [machine identities](/documentation/platform/identities/machine-identities) (representing services, CI/CD pipelines, or agents). The same roles and permissions can be applied to either type of identity.
|
||
|
||
To manage access at scale, KMS also supports [user groups](/documentation/platform/groups) — roles assigned to a group apply to all of its members automatically.
|
||
|
||
Note that KMS distinguishes between organization-level and project-level access control:
|
||
|
||
- [Organization-level access control](/documentation/platform/access-controls/role-based-access-controls#organization-level-access-controls): Roles and permissions governing access to organization-level resources and controls such as billing, member management, and identity provider configuration.
|
||
- [Project-level access control](/documentation/platform/access-controls/role-based-access-controls#project-level-access-controls): Roles and permissions governing access to resources and workflows within a specific project (e.g., secrets, certificates, SSH hosts).
|
||
|
||
|
||
|
||
To learn more about how permissions work in detail, refer to the [access control documentation](/documentation/platform/access-controls/overview).
|
||
|
||
<Info>
|
||
KMS provides immutable roles such as `admin` and `member` for free.
|
||
|
||
If you're using KMS Cloud, the ability to create custom roles is available under the **Pro Tier**.
|
||
|
||
If you're self-hosting KMS, then you should contact [email protected] to purchase an enterprise license to use it.
|
||
|
||
</Info>
|
||
|
||
## Usage & Billing
|
||
|
||
The _Usage & Billing_ tab provides an overview of your organization's billing information and platform usage.
|
||
|
||
KMS calculates usage at the organization level—aggregating activity across all projects and product types (e.g., Secrets Management, PAM, PKI). From this tab, you can track usage, view billing details, and manage your KMS Cloud subscription.
|
||
|
||
|
||
|
||
## Audit Logs
|
||
|
||
KMS provides a unified view of [audit logs](/documentation/platform/audit-logs) at the organization level. All platform activity—including secret access, certificate issuance, platform logins across the organization —is recorded and searchable in a central log view.
|
||
|
||
Audit logs are also viewable at the project level, where they are scoped to show only events relevant to that specific project. This allows project administrators to monitor activity and investigate changes without requiring organization-wide access.
|
||
|
||
## App Connections
|
||
|
||
KMS supports [app connections](/integrations/app-connections/overview) — integrations configured at the organization level with third-party platforms such as AWS, GCP, GitHub, and many others.
|
||
|
||
Once configured, these connections can be reused across multiple projects as part of any feature that requires third-party integrations—such as [secret syncing](/integrations/secret-syncs/overview) or [dynamic credential generation](/documentation/platform/dynamic-secrets/overview).
|
||
|
||
|
||
|
||
To learn more, refer to the [app connections documentation](/integrations/app-connections/overview).
|
||
|
||
## Organization Settings
|
||
|
||
The _Organization Settings_ tab lets you configure global behavior and security controls for the organization.
|
||
|
||
Key configuration areas include:
|
||
|
||
- General: Manage the organization’s name, slug, and default role for newly invited members.
|
||
- Single Sign-On (SSO): Enable [SAML](/documentation/platform/sso/overview), [LDAP](/documentation/platform/ldap/overview), or [OIDC-based](/documentation/platform/sso/general-oidc/overview) authentication for user login.
|
||
- Provisioning: Enable [SCIM](/documentation/platform/scim/overview) to automatically provision and deprovision users and groups from an identity provider.
|
||
- Security Policies: Enforce MFA and configure session duration limits.
|
||
- Encryption: Integrate with external KMS systems or bring your own encryption keys (BYOK).
|
||
- [Audit Log Streaming](/documentation/platform/audit-log-streams/audit-log-streams): Forward audit events to third-party logging tools like SIEMs or cloud storage.
|
||
- Workflow Integrations: Trigger [Slack](/documentation/platform/workflow-integrations/slack-integration) or [Microsoft Teams](/documentation/platform/workflow-integrations/microsoft-teams-integration) notifications for events like access requests.
|
||
- [Project Templates](/documentation/platform/project-templates): Define default environments, roles, and settings to standardize project creation.
|
||
- KMIP (Enterprise): Connect to KMIP-compatible HSMs for hardware-backed key storage and operations.
|
||
|
||
|