Account and User Management
Organizations and Accounts
An account in the Datafy app maps 1:1 to a single AWS account. If you have multiple AWS accounts (for example, separate AWS accounts for production, staging, and development), each one will have its own Datafy account.
An organization groups accounts and users under a single top-level entity, typically a company or business unit. Every account belongs to exactly one organization, and an organization can contain any number of accounts.
Users, SSO, and security settings are typically configured at the organization level, but can also be managed per account. Datafy permissions (IAM roles) and autoscaling rules operate at the account level but can be viewed and edited from the organization view as well. Configurations are scoped to either level, with a hierarchy tree shown in both views.
Account Creation
Your organization is provisioned by the Datafy team as part of onboarding. Once the organization exists, Admins can create additional sub-accounts — either from the Admin Portal in the Datafy app, or programmatically via API or Datafy's dedicated Terraform provider.
To create a sub-account from the app:
Log in to the organization (see below).
Open the Admin Portal from the account menu.
Navigate to All Accounts and select the your organization from the account lis
Navigate to the Sub-Accounts tab and select Create Sub-Accounts.
Provide the account name.
To finish setup, create and configure the new account's IAM role.
The IAM role can be configured from the Permissions page of the sub-account, or from the organization's Permissions page, which lists every account in one view.
Accessing Accounts and Organizations
The account menu in the top bar lists every organization and account you have access to, with accounts grouped under their respective organization. Select one to view it.
Account view — volumes, autoscaling rules, optimization actions, and configurations for a single account.
Organization view — a roll-up across every account in the organization that you have access to. Aggregated metrics (such as total managed volume size) are summed across accounts. List views show every resource from every account, with an extra Account column so you can see which account each one belongs to.
Resources always belong to a single account, but the organization view lets you see them all together.
Managing Users
Admins can invite users, assign roles, and remove users from the Admin Portal, through either the Users or All Accounts sections.
Users — select Invite User and choose a role. The user is added to the account the admin is currently logged in to.
All Accounts — select an account from the list, open its Users tab, and click Invite Users. Set the desired sub-account access. The user is added to the account the admin selected.
Users of the organization with sub-account access enabled have access to every sub-account. Users without sub-account access can still see every account's data in the organization view. To grant access, or assign a different role, on a specific sub-account, invite the user to that account directly.
User Roles
Datafy has three user roles:
Readonly
View volumes, reports, rules, and configurations. Cannot make changes.
User
Everything in Readonly, plus activate and deactivate autoscaling and create and manage autoscaling rules.
Admin
Everything in User, plus edit configurations, manage users and accounts, configure the AWS IAM Role ARN, and generate API tokens.
Roles are assigned when a user is invited and can be changed at any time by an Admin.
Authentication and Security
Authentication and security settings are configured through the Admin Portal, under Security and SSO. These settings are only available to Admins.
If you have requirements not covered here — such as specific compliance standards or identity provider configurations — reach out and we'll help you find a solution.
Single Sign-On (SSO)
Datafy supports SSO via SAML and OpenID Connect (OIDC). You can connect your existing identity provider — such as Okta, Microsoft Entra ID (Azure AD), Google Workspace, or others — to allow users to log in with their corporate credentials.
To set up SSO, go to Admin Portal → SSO and select Setup SSO Connection. Pick the connection type and follow the on-screen wizard.
SSO is matched by email domain. Once configured, all users with a matching email domain are redirected to your identity provider. Which users are allowed to authenticate is controlled on the identity provider side — Datafy does not manage individual SSO access.
If you have multiple accounts, configure SSO from the organization view rather than on each individual account. This ensures consistent authentication and avoids repeating the setup.
During SSO setup, you'll be asked to validate your email domain by adding a DNS record. If your organization can't make DNS changes, contact us — we can validate the domain on your behalf.
Other Security Controls
The Admin Portal's Security page exposes additional access controls:
Multi-factor authentication (MFA) — Admins can make MFA optional (users can enable it themselves) or forced (all users must log in with MFA). Configure under Security → MFA → Manage.
Domain restrictions — allow or block specific email domains from signing up or being invited. Configure under Security → Restrictions → Manage.
IP restrictions — limit access by IP address. Configure under Security → Restrictions → Manage, then toggle IP Address Restriction.
Programmatic Access
API Tokens
Datafy uses bearer tokens to authenticate non-interactive access — agent installations, API calls, and Terraform-driven account management. Generate tokens from the Admin Portal under API Tokens.
Token scope depends on where you generate the token from:
The organization view
The organization and all its sub-accounts
API calls across multiple accounts (with the accounts= parameter), Terraform-driven account management
See Token Generation for generation instructions, and the API documentation for full details on token scopes and the accounts= query parameter.
Terraform Provider
The datafy Terraform provider lets you manage Datafy accounts, AWS IAM role associations, access tokens, and autoscaling rules programmatically. This is the recommended approach for organizations with large or dynamic numbers of AWS accounts.
The provider requires an organization-level token, since creating and managing accounts operates across the organization. Generate one from the organization view.
The provider and full documentation are available on the Terraform Registry.
The datafy provider manages Datafy account resources (accounts, tokens, autoscaling rules). For reconciling Terraform state with Datafy-managed EBS volumes, see IaC Reconciliation, which covers the separate datafyaws provider.
Last updated
Was this helpful?