# Inside Figma: getting out of the (secure) shell

DevFeed: [Inside Figma: getting out of the (secure) shell](<https://devfeed.tech/articles/inside-figma-getting-out-of-the-secure-shell-9851.md>)

Original publisher: [Read original article](<https://www.figma.com/blog/inside-figma-getting-out-of-the-secure-shell/>)

Author: Hongyi Hu

Published: 2021-09-02T00:00:00Z

Content type: article

Language: en

Sources: [Figma Blog](<https://devfeed.tech/sources/figma-blog.md>)

Topics: [Figma](<https://devfeed.tech/topics/figma.md>), [Zero Trust](<https://devfeed.tech/topics/zero-trust.md>), [Security](<https://devfeed.tech/topics/security.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [OpenSSH](<https://devfeed.tech/topics/openssh.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [aws](<https://devfeed.tech/tags/aws.md>), [figma](<https://devfeed.tech/tags/figma.md>), [logging](<https://devfeed.tech/tags/logging.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>), [security](<https://devfeed.tech/tags/security.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [sso](<https://devfeed.tech/tags/sso.md>), [zero-trust](<https://devfeed.tech/tags/zero-trust.md>), [zero-trust-networking](<https://devfeed.tech/tags/zero-trust-networking.md>)

## AI overview

This Inside Figma article describes how Figma's security team built a zero-trust shell access system on AWS using AWS SSO and Systems Manager. It explains the limitations of bastion-host SSH access at scale and outlines goals including smooth user experience, phishing-resistant multi-factor authentication, short-lived rotating credentials, centralized logging, minimal maintenance effort, and incremental rollout.

## Source excerpt

Security Engineer Hongyi Hu explains how the Figma security team built a simple solution for zero-trust shell access on AWS.