Your network team is tired of waiting. Someone needs temporary admin rights to push a config, but compliance wants a paper trail. Minutes turn into hours. Production windows close. That’s the gap Arista Temporal aims to close—short-lived, secure access that feels instant yet still auditable.
Arista Temporal combines Arista’s network automation stack with the concept of ephemeral access controls. Instead of giving permanent credentials, it grants time-bound, policy-driven sessions. You get just enough permission to get work done, nothing left lingering after. It’s the same philosophy Kubernetes brings to pods: disposable, predictable, and easy to observe.
At its core, Temporal defines “when” and “how long.” Arista handles “who” and “what.” Together, they create a feedback loop between identity and intent. When a user requests privileged access—say through Okta or AWS IAM—the Temporal service issues a signed token that expires after a defined interval. This token is validated by Arista’s control plane before running any command. Once time’s up, the key vanishes and so does the authority.
Integration workflow
Picture this: a developer opens a pull request that modifies switch configurations. A Git hook calls Temporal for approval logic, verifying RBAC rules directly against the identity provider. If compliant, Arista’s CloudVision activates the session route for 15 minutes. Every action gets logged against the source user. At expiration, Temporal revokes the token automatically, leaving no leftover credentials to haunt you later.
Best practices
Keep Temporal tokens short—under an hour for privileged operations. Map RBAC groups from your IdP to Arista roles to avoid mismatched permissions. Rotate signing keys regularly and ensure all audit logs feed a system that meets SOC 2 requirements. The fewer places you store static credentials, the smaller the blast radius.