Access to resources in a production environment is a double-edged sword. On one hand, it’s necessary for maintaining and operating critical infrastructure; on the other hand, unrestricted access can lead to catastrophic consequences if not properly managed.
Without effective Just In Time Privileges:
Before PAM, GCP provided several options that was in the best case, not as secured, and in the worst case, very difficult to make it work in a real world scenario:
PAM is here to provide a solution to all drawbacks presented in the previous chapter. This GCP product was publish as preview in April 2024 and was released in GA in September 2024.
PAM allows to manage just in time access defined by an Google Cloud administrator directly through the GCP console.
PAM provides the following configurations:
The object to manage just in time elevation are called entitlements . They are composed of multiple attributes:
The entitlements are linked to an Organization, a Folder or a Project.
PAM solution looks very similar with Azure Privileged Identity Management. This service, available through Azure Entra ID since 2016, provides oversight and control over privileged accounts. It allows administrators to enforce just-in-time access, requiring users to request elevated privileges for specific tasks. These elevated roles are temporary and subject to approval workflows, reducing the risk of long-term, excessive access.
AWS does not provide any managed solution to tackle this problematic but points to external solutions to manage just in time access:
Even if the service is only available as Pre GA, the google provider in terraform propose a resource to create a PAM Entitlement.
resource "google_privileged_access_manager_entitlement" "this" {
entitlement_id = "my-entitlement"
location = "global"
max_request_duration = "14400s"
parent = "projects/my-project-name
requester_justification_config {
unstructured{} // force to have a justification
}
eligible_users {
principals = [ // list of principals that can ask for a privileged escalation
"<group:run@theodo.com>"
]
}
privileged_access{
gcp_iam_access{
role_bindings{
role = ""
}
resource = "//cloudresourcemanager.googleapis.com/projects/my-project-name"
resource_type = "cloudresourcemanager.googleapis.com/Project"
}
}
additional_notification_targets {
admin_email_recipients = [
"admin@theodo.com",
]
requester_email_recipients = [
"all@theodo.com"
]
}
/* approval_workflow { // This section is needed if you want to have an approver.
manual_approvals {
require_approver_justification = true
steps {
approvals_needed = 1
approver_email_recipients = [
"admin@theodo.com"
]
approvers {
principals = [
"<group:admin@theodo.com>"
]
}
}
}
}
*/
}
The precedent example is suitable for run team that need to intervene during non-working hours (in case of an production incident.
If you want to set approvers for each privileged access request, you need to comment the approval_workflow block. This pattern is suitable for development team that need to access or debug on production, to access specific data.
This resource need to add some rights to the PAM Service Agent if you want to deploy it fully without any human intervention.
resource "google_project_iam_member" "pam" {
project = my_project_id
role = "roles/privilegedaccessmanager.serviceAgent"
member = "serviceAccount:service-org-${var.org_id}@gcp-sa-pam.iam.gserviceaccount.com"
}
Once the entitlement is set, an eligible Principal can log to the Google Console. Go to the IAM & Admin > PAM
Create a request
Once activated, you can now access to the project with higher privileged rights
As an administrator, you can check the entitlements, the reason of each entitlements and check what was done during the session.
PAM offers a way to manage JIT access and allows balance between security and needs to have specific rights for incident intervention or production maintenance. We are implementing and testing this solution with one of our client and we will see how the development teams and interventions are reacting to this new feature.