# PAM Configuration

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FGEDJmvpUaT8ImnYLgjLV%2FKeeperPAM%20Configuration.jpg?alt=media&#x26;token=657572ec-45bc-4e1a-a219-2402c655252a" alt=""><figcaption></figcaption></figure>

## Overview

In Keeper, the **PAM Configuration** contains essential information of your target infrastructure, settings and associated Keeper Gateway. We recommend setting up one PAM Configuration for each Gateway and network being managed.

## Creating PAM Configuration

To create a new PAM Configuration:

* Login to the Keeper Vault
* Select Secrets Manager and the "PAM Configurations" tab
* Click on "New Configuration"

## PAM Configuration Fields

When setting up the PAM Configuration, you have the option of choosing one of the following environments:

* [Local Network](#local-network-environment)
* [AWS](#aws-environment)&#x20;
* [Azure](#aws-environment)
* [Google Cloud](#google-cloud-environment)
* [Domain Controller](#domain-controller-environment)

The following tables provides more details on each configurable fields in the PAM Configuration record regardless of the environment you choose:

<table><thead><tr><th width="207.33333333333331">Field</th><th>Description</th><th>Notes</th></tr></thead><tbody><tr><td>Title</td><td>Name of PAM configuration record</td><td>Ex: <code>US-EAST-1 Config</code></td></tr><tr><td>Gateway </td><td>The configured gateway </td><td>See <a href="gateways">docs</a> for more info</td></tr><tr><td>Application Folder</td><td>The shared folder where the PAM Configuration data will be stored</td><td>Best practice is to create a folder with limited access to admins. See Security Note (1) below</td></tr><tr><td>PAM Settings </td><td>List of Zero-Trust KeeperPAM features that should be enabled </td><td>See <a href="#pam-features-on-pam-configuration">this section</a> for more info</td></tr><tr><td>Default Rotation Schedule </td><td>Specify frequency of Rotation </td><td>Ex: <code>Daily</code></td></tr><tr><td>Port Mapping</td><td>Define alternative default ports </td><td>Ex: <code>3307=mysql</code><br>See <a href="../references/port-mapping">port mapping</a> docs</td></tr></tbody></table>

{% hint style="danger" %}
**Security Note (1)**\
\
The PAM Configuration information is stored as a record in the vault inside the specified **Application Folder** and may contain secrets. Therefore, we recommend that the Application Folder should be limited in access to only privileged admins.
{% endhint %}

The following tables provides more details on each configurable fields in the PAM Network Configuration record based on the environment you chose:

### Local Network Environment

<table><thead><tr><th width="212">Field</th><th width="251">Description</th><th width="282">Notes</th></tr></thead><tbody><tr><td>Network ID</td><td>Unique ID for the network</td><td><p>This is for the user's reference </p><p>Ex: <code>My Network</code></p></td></tr><tr><td>Network CIDR</td><td>Subnet of the IP address</td><td>Ex: <code>192.168.0.15/24</code><br>Refer to <a href="https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing">this </a>for more info</td></tr></tbody></table>

### AWS Environment

<table><thead><tr><th width="195">Field</th><th width="318">Description</th><th>Notes</th></tr></thead><tbody><tr><td>AWS ID</td><td>A unique id for the instance of AWS</td><td>Required, This is for the user's reference <br>Ex: <code>AWS-US-EAST-1</code></td></tr><tr><td>Access Key ID</td><td>From an IAM user account, the Access key ID from the desired Access key.</td><td>Leave Empty when EC2 instance role is assumed.</td></tr><tr><td>Secret Access Key</td><td>The secret key for the access key.</td><td>Leave Empty when EC2 instance role is assumed.</td></tr><tr><td>Region Names</td><td>AWS region names used for discovery. Separate newline per region</td><td>Ex:<br>us-east-2<br>us-west-1</td></tr><tr><td>Port Mapping</td><td>Any non-standard ports referenced. Separate newline per entry</td><td>Ex:<br>2222=ssh<br>3390=rdp</td></tr></tbody></table>

* See additional information on [AWS Environment Setup](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/pam-configuration/aws-environment-setup)

### Azure Environment

<table><thead><tr><th width="185">Field</th><th width="352">Description</th><th>Notes</th></tr></thead><tbody><tr><td>Azure ID</td><td>A unique id for your instance of Azure</td><td>Required, This is for the user's reference <br>Ex: <code>Azure-1</code></td></tr><tr><td>Client ID</td><td>The application/client id (UUID) of the Azure application</td><td>Required</td></tr><tr><td>Client Secret</td><td>The client credentials secret for the Azure application</td><td>Required</td></tr><tr><td>Subscription ID</td><td>The UUID of the subscription (i.e. Pay-As-You-GO).</td><td>Required</td></tr><tr><td>Tenant ID</td><td>The UUID of the Azure Active Directory</td><td>Required</td></tr><tr><td>Resource Groups</td><td>A list of resource groups to be checked. If left blank, all resource groups will be checked. Newlines should separate each resource group.</td><td></td></tr></tbody></table>

* See additional information on [Azure Environment Setup](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/pam-configuration/azure-environment-setup)

### Google Cloud Environment

<table><thead><tr><th width="195">Field</th><th width="282.8515625">Description</th><th>Notes</th></tr></thead><tbody><tr><td>GCP ID</td><td>A unique id for the instance of Google Cloud</td><td>Required, This is for the user's reference. Example:<br><code>GCP-US-CENTRAL1</code></td></tr><tr><td>Google Workspace Administrator Email</td><td>The email address for a Google Workspace administrator account that can be used to manage passwords for GCP Principals.</td><td>Leave Empty if no such account exists, or if the environment does not require Principal rotation.</td></tr><tr><td>Service Account Key</td><td>The service account key in JSON format.</td><td><p>Required. Example: </p><pre class="language-json"><code class="lang-json">{
  "type": "service_account",
  "project_id": "&#x3C;project-id>",
  "private_key_id": "&#x3C;private-key-id>",
  "private_key": "&#x3C;private-key>",
  "client_email": "&#x3C;client-email>",
  "client_id": "&#x3C;client-id>",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/&#x3C;app-identifier>.iam.gserviceaccount.com"
}
</code></pre></td></tr><tr><td>Region Names</td><td>AWS region names used for discovery. Separate newline per region</td><td>Example:<br>us-east4<br>us-south1</td></tr><tr><td>Port Mapping</td><td>Any non-standard ports referenced. Separate newline per entry</td><td>Example:<br>2222=ssh<br>3390=rdp</td></tr></tbody></table>

* See additional information on [Google Cloud Environment Setup](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/pam-configuration/google-cloud-environment-setup)

### Domain Controller Environment

| Field                     | Description                                                                                                                                        | Required |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| Administrative Credential | Credentials of a domain administrator or an account with equivalent privileges, required to perform full discovery and access all domain resources | Yes      |
| Hostname and Port         | Hostname and port for the domain controller.                                                                                                       | Yes      |
| Domain ID                 | The FQDN domain used by the Domain Controller. For example, EXAMPLE.COM and not EXAMPLE.                                                           | Yes      |
| Use SSL                   | If using LDAPS (default 636), check the box. If using LDAP (default 389), uncheck the box.                                                         | Yes      |
| Scan Network              | Scan the CIDRs from the domain controller. Default to False.                                                                                       | No       |
| Network CIDR              | Scan additional CIDRs from the field.                                                                                                              | No       |
| Port Mapping              | Define alternative default ports                                                                                                                   | No       |

## PAM Features on PAM Configuration

The **"PAM Features Allowed"** and **"Session Recording Types Allowed"** sections in the PAM Configuration allow owners to enable or disable KeeperPAM features for resources managed through the PAM configuration:

<table><thead><tr><th width="353">Field</th><th>Description</th></tr></thead><tbody><tr><td>Rotation </td><td>If enabled, allow rotations on privileged user users managed by this PAM configuration </td></tr><tr><td>Connections</td><td>If enabled, allow connections on resources managed by this PAM configuration </td></tr><tr><td>Remote Browser Isolation (RBI)</td><td>If enabled, allow RBI sessions on resources managed by this PAM configuration </td></tr><tr><td>Tunneling</td><td>If enabled, allow tunnels on resources managed by this PAM configuration </td></tr><tr><td>Graphical Session Recording</td><td>If enabled, visual playback sessions will be recorded for all connections and RBI sessions</td></tr><tr><td>Text Session Recording (TypeScript)</td><td>If enabled, text input and output logs will be logged for all connections and RBI sessions </td></tr></tbody></table>