Privileged access (PAM): overview and where to start

Privileged access keeps administration credentials (servers, databases) in a vault, hands them only to people who asked and were approved, for the time requested, and records the sessions. Sessions go through an Edge appliance in your network.

Main pieces

Where do I start?

1. Install and confirm an Edge appliance and turn on the «Privileged access» module. See Install the appliance.
2. Review «PAM settings» (recording retention). See PAM settings.
3. Create the approver groups under «Manage» › «Groups».
4. Create an access profile. See Access profiles.
5. Register a target and its accounts, set the credential and assign the profile. See Targets and accounts.
6. Publish a policy rule that allows pam.session, pam.checkout or pam.jit.
7. Ask someone to make a test request under «Access» › «My access».

Recommended protections

• «Dual control» for sensitive changes.
• A break-glass group with at least two members.
• An offline escrow key for the vault.

Limits

By default each organization can have up to 10 gateways and 500 GiB of recordings; your provider adjusts them. Only SSH sessions are supported today. In development, and not available yet: recorded remote desktop sessions (RDP), recorded database sessions (PostgreSQL) and application secrets for applications and CI pipelines.