If you are on call while travelling, plan three things before you leave: a network you control, such as a phone hotspot plus a backup SIM or second device, a scoped and expiring role for production, and a swap or escalation plan if you cannot respond. Do not solve reachability by carrying permanent admin keys.
The problem
On call work needs fast access at awkward times, often from a place you do not control. The usual shortcut is to keep full admin credentials on the laptop and use whatever network is available. That is the combination that turns a lost laptop into an incident.
Pick the network first
Use your phone hotspot as the main path and keep a backup. The Android help page notes a hotspot can share mobile data with up to 10 devices, so one phone can serve a laptop and a tablet. For a backup, carry a second phone with a different carrier, or know where a wired connection is. See Phone hotspot or hotel Wi-Fi for work and How to secure a phone hotspot.
Test it. Do a dry run of the on call tools on the hotspot before the trip: paging app, VPN or access tool, dashboards and the deploy path.
Scope the access
| Option | Description | When to use |
|---|---|---|
| Read only plus approval | See dashboards; changes need a second person | Most travelling on call |
| Time boxed role | Roles that expire at the trip end | Staff on call all trip |
| Break glass account | Held by a small group at home, alerts when used | Rare emergencies |
| Standing admin keys on laptop | Always available | Avoid |
On AWS, temporary credentials last until they expire unless revoked, which is why a shorter duration helps. See How to revoke AWS sessions after a lost laptop.
Make the alerting travel friendly
- Set time zone aware schedules so you are not paged in the middle of a flight.
- Put a second responder on the rota who is at home.
- Keep runbooks in a place that works from a phone.
- Agree a rule: if the alert needs production changes and you are on an untrusted network, escalate to the home responder.
Plan the swap
A swap is often safer than staying on call. If you will be in the air, in a conference hall or somewhere with poor signal, hand the rota to a colleague. Record it in the on call tool so the paging goes to the right person.
Protect the device
Even on call, keep disk encryption, a short screen lock and a hardware key. Use SSH agent lifetimes and confirmation so loaded keys expire.
After the shift
Review what you did. Remove time boxed access and rotate any credential you pasted into a terminal over a weak network. Run the post trip review.
Safeguard does not run your pager or manage cloud roles. It covers dependency scanning, SBOMs, policy gates and fix PRs that are off by default and stay on manual approval, which can help when an urgent patch has to be reviewed from the road. A free scan is available.
Quick check
Is a VPN enough for on call from hotel Wi-Fi?
It helps the network path, but a hotspot is still preferred, and you should limit what the access can do if the laptop is lost.
Who should hold break glass credentials?
A small group at home, with alerts on use and a review after each use.
Sources
- Share a mobile connection by hotspot or tethering on Android, Android Help
- Revoke IAM role temporary security credentials, AWS IAM User Guide
Last reviewed: 19 October 2026.
