Privileged Access Management

⭐️⭐️☁️ PlatformImplement appropriate security controls for privileged access as defined in the Authorization Concept. These must cover access to administrative cloud platform roles (e.g. Global Admins, Global Readers) and shared services (e.g. on-premise connectivity hubs).

What Is Privileged Access Management (PAM)?

In an enterprise environment, “privileged access” is a term used to designate special access or abilities above and beyond that of a standard user. Privileged access allows organizations to secure their infrastructure and applications, run business efficiently and maintain the confidentiality of sensitive data and critical infrastructure.

Access to cloud tenants is usually not a privileged operation from a cloud foundation perspective but for application teams it is the other way round. From the application team perspective, cloud tenants are an infrastructure and access to the application infrastructure is usually administrative/privileged. Application teams using these cloud tenants need to be equipped with appropriate means to secure access to the environments.

Key Points

Below you will find some important points to understand PAM better:

  • Let us first understand what is open and closed landing zone.

    Open landing zone designs allow teams to create and modify Identity and Access Management (IAM) roles and permissions on cloud tenants. The cloud foundation only enforces a minimum set of IAM policies on the tenant.

    Closed landing zone designs on the other hand prevent teams from creating or modifying IAM roles and permissions on cloud tenants. Teams must request all such changes via the cloud foundation team.

    For more details on authorization and privileged access, please refer to the topic Resource Authorization Management.

  • Emergency access accounts are highly privileged, and they are not assigned to specific individuals. Emergency access accounts are limited to emergency or "break glass"' scenarios where normal administrative accounts can't be used. It is recommended that you maintain a goal of restricting emergency account use to only the times when it is absolutely necessary. For example, when an important application has stopped functioning and operating users needs access to debug and fix the problem or when project access for a specific user must be immediately revoked due to an account compromise.

  • PAM is grounded in the principle of least privilege wherein users only receive the minimum levels of access required to perform their job functions. The principle of least privilege is widely considered to be a best practice and is a fundamental step in protecting privileged access to high-value data and assets.

Implementation of PAM

Azure Active Directory (AAD)

Privileged Identity Management (PIM) is a service in Azure Active Directory (Azure AD) that enables you to manage, control, and monitor access to important resources in your organization. For more details, please refer to Azure AD Privileged Identity Managementopen in new window.

Google Cloud Identity

In Azure it is possible to restrict access to the production environment using Azure AD. This can be achieved using Google Cloud Organization Service. Also, if you use Google Cloud Directory Sync you can manage users through Azure Active Directory and use it to authenticate against Google Cloud.

AWS SSO

PAM solutions are designed to enforce consistent PAM best practices every time a new AWS account is set up, whether that’s by the security team, the infrastructure team or a single developer building an application. For more details, please refer to Managing temporary elevated accessopen in new window.

  • GCP Fabric FAST

    Leverages the use of groups instead of directly assigning roles to users. The principle of least privileged is applied by assigning only necessary roles for each group. Furthermore, service accounts are created for automation that can be impersonated by selected groups.

    Learn More open in new window
  • GCP CFT - Example Foundation

    Leverages the use of groups instead of directly assigning roles to users. The principle of least privileged is applied by assigning necessary roles for each group. Furthermore, service accounts are created for automation that can be impersonated by selected groups.

    Learn More open in new window
  • GCP Setup Checklist

    Leverages the use of groups instead of directly assigning roles to users. The principle of least privileged is applied by assigning necessary roles for each group. Furthermore, service accounts are created for automation that can be impersonated by selected groups.

    Learn More open in new window
  • Azure CAF Terraform Modules

    Service Principals created and have privilege only on each specific level, You can impersonate them to deploy modules from that level

    Learn More open in new window
  • AWS Control Tower with Account Factory

    Uses IAM Identity Center service to offer preconfigured groups. You can then add users to those groups based in their role in the organization.

    Learn More open in new window
  • AWS Control Tower with AFT

    By default, the user email set in the account request is assigned AdministratorAccess to the account. Additionally, groups created with CT are assigned with specific permissions. That is, AWSSecurityAuditPowerUsers group is assigned. AWSPowerUserAccess , AWSControlTowerAdmins group is assigned AWSOrganizationsFullAccess , AWSSecurityAuditors group is assigned AWSReadOnlyAccess to that account.

    Learn More open in new window
  • AWS Landing Zone Accelerator

    By default it defines only an Administrator group. But as you can base it on AWS Control Tower, you can make use of the advanced default roles created by AWS Control Tower.

    Learn More open in new window
Last Updated: