In this section, you will learn how to rotate DB User or Admin credentials on the following Azure Managed Databases:

• Azure SQL

• Azure MySQL

Prerequisites

An active license is required in order to use the features available with KeeperPAM. This license is available for both business and enterprise customers.

Overview

In this guide, you'll learn how to remotely rotate MacOS accounts via SSH using Keeper Rotation. For a high-level overview on the rotation process in the local network, visit this .

Overview

In this section, you will learn how to rotate DB User or Admin credentials on the following Google Cloud Managed Databases:

In this section, you will learn how to rotate database user credentials within your local network.

Databases Supported

Attaching Post Rotation Scripts

When creating or editing a PAM record, click on the Add PAM Script button

Clicking on Add PAM Script will allow you to:

Keeper can automatically rotate a client secret in Azure. Please see the Azure Client Secret section of the .

Keeper can automatically rotate an IAM User Access Key in AWS. Please see the AWS Access Key section of the SaaS Plugin documentation.

Overview

KeeperPAM Password Rotation enables customers to securely and automatically rotate credentials across cloud-based and on-premises environments, including Active Directory accounts, Windows and Linux users, database passwords, Azure IAM accounts, AWS accounts, Google Workspace accounts, SSH keys, and more. Adhering to Keeper’s Zero Trust and Zero Knowledge security model, this feature helps organizations mitigate risks associated with weak, reused, or long-standing credentials, as well as threats such as breaches, terminations, and dark web exposure.

Features

• Comprehensive Credential Rotation: Automate rotation for machines, service accounts, and user accounts across your infrastructure and multi-cloud environments.

• Flexible Scheduling: Schedule rotations to occur at any time or trigger them on demand.

• Service Management: Automatically update the log on credentials for Windows services and scheduled tasks after rotation.

• Post-Rotation Actions

Architecture

Rotation is performed on the Keeper Gateway and controlled through the Keeper Web Vault, Desktop App or Commander CLI.

How does Password Rotation Work?

In KeeperPAM, the way Password Rotation works is as follows:

• The record holds the credential that is being rotated.

• The Rotation Settings of the PAM User record references a specific PAM Machine, PAM Database or PAM Directory resource. This is the target resource where the rotation is performed.

• The uses the Admin Credential associated to the PAM Machine, PAM Database or PAM Directory resource to perform the rotation with native protocols.

• For AWS, Azure and GCP resources, the record holds the necessary rights and access keys to perform rotations with cloud native APIs.

Overview

In this section, you will learn how to rotate user credentials within a Local Network environment across various target systems.

A "local network" simply means any resource that has line of sight access from the Keeper Gateway. This configuration can be used in any cloud or managed environment. Native protocols are used to communicate to the target resources and perform rotations.

Setup Steps

At a high level, the following steps are needed to successfully rotate passwords on a network:

1. Create Shared Folders to hold the PAM records involved in rotation

2. Create PAM Machine, PAM Database and PAM Directory records representing each resource

3. Create PAM User records that contain the necessary account credentials for each resource

4. Link the PAM User record to the PAM Resource record.

Use Cases

Overview

In this section, you will learn how to rotate DB User or Admin credentials on the following AWS Managed Databases:

The setup and configuration of Keeper Rotation is defined by the use case. Keeper supports any cloud or on-prem environment.

Local Network

• Active Directory

• See the Keeper for updates

Overview

Post-rotation scripts (PAM Scripts) are user-defined software programs that can perform privilege automation tasks. Scripts can be attached to any PAM resource records in the vault. Depending on the PAM record the script is attached to, the script will execute either on the Keeper Gateway, or the remote host where password rotation occurred.

The following table shows all the available PAM Records and where the attached script will execute:

Rotation Options on PAM User Records

When setting up rotation on a record on a PAM User record, you can select from one of the following methods:

• General

• IAM User

• Run PAM scripts only

When the "General" or "IAM User" methods are selected, Keeper will attempt to rotate the credentials using built-in capabilities based on the information stored in the record.

When the "Run PAM scripts only" option is selected, Keeper will skip the default rotation task and immediately run the attached PAM scripts on the gateway.

Order of Execution

Scripts will be executed in the following order:

1. Scripts attached on PAM User records

2. Scripts attached on PAM Machine, PAM Database, or PAM Directory Record types

3. Scripts attached on PAM Configuration Record types

If multiple scripts are attached to a record, scripts will be executed in the order they appear on the PAM Record.

Common Use Cases

Here are some of the use cases made possible with Keeper Post-Rotation Scripts:

• Custom rotation scripts for any type of target

• Revoking access to a resource

• Sending notifications to team members

• Propagating the password change to other systems

Documentation included

Overview

In this section, you will learn how to rotate user credentials within the Azure network environment across various target systems. Rotation works on the devices configured and attached to the Azure Active Directory (Azure AD) which can also be your default directory.

KeeperPAM can rotate the password for Azure AD users, service accounts, local admin users, local users, managed services, databases and more.

Echo Inputs

The below example post-rotation scripts simply echo the input parameters in various languages and platforms. The output of the print statements can be found in the Keeper Gateway log file.

Overview

Upon successful rotation of credentials on a PAM record, Keeper executes the attached Post-Rotation scripts with parameters containing information on the involved records, credentials, and user.

Overview

In this section, you will learn how to rotate user credentials within the Google Cloud environment across various target systems and services.

Overview

In this section, you will learn how to rotate user credentials within the AWS Cloud environment across various target systems and services.

Overview

KeeperPAM Password Rotation is able to automatically manage the "log on" credentials for Windows services and scheduled tasks.

When rotation is performed for a specific PAM User record, the Keeper Gateway will update the credentials for all services and scheduled tasks on the associated PAM Machine, and restart the services. One PAM User record can be associated to any number of PAM Machine records, allowing you to update the services and scheduled tasks across a fleet of servers.

Prerequisites

This guide assumes the following tasks have already taken place:

• are configured for your role

• A Keeper Secrets Manager has been created

• Your is online

• The Keeper Gateway can communicate over WinRM or SSH to the target machine:

Setup

Service account and scheduled task management works by associating a PAM User record with one or more PAM Machine records in the vault. This mapping tells the Keeper Gateway to reach into each machine and look up any services running as the user, updating the password and restarting the service.

Using Discovery

When running a , Keeper will automatically locate any services or scheduled tasks that require update when a password is rotated.

If you don't use Discovery, this can be managed directly through the Commander CLI interface using the pam action service commands.

Using the Commander CLI

Keeper Commander provides the necessary commands to associate services and scheduled tasks, such that password rotations will trigger an update and restart of the service.

Installing Commander

If you haven't set up Keeper Commander yet, please follow the .

Locate Gateway UID

Use the pam gateway list command to locate the Gateway UID which manages the machine containing the services and scheduled tasks. You'll need this for the next step.

Locate PAM Machine and PAM User UID

The PAM Machine and PAM User UIDs can be found in Commander by using the ls -l command inside a folder or by using the search command.

The UIDs can also be found in the Keeper Vault "Record Information" screen:

Services Management Commands

Use the pam action service command to instruct Keeper to update services and scheduled tasks on a particular machine, for a particular user, within a network.

Adding a Service / Task / IIS

To instruct Keeper to update and restart services and scheduled tasks on a particular machine, use the syntax below:

Removing a Service / Task / IIS

To instruct Keeper to remove the associations of services and scheduled tasks on a machine:

Listing all Mappings

To display the current mappings between Gateway, Machine and User accounts where services and tasks need to be managed, use the pam action service list command.

Triggering the service update

To perform a password rotation of a PAM User account, click on the Rotate button from the vault user interface.

To perform the rotation from Commander, run pam action rotate :

To view the status of the rotation job, check the Vault UI or run the pam action job-info command as instructed:

Troubleshooting

Service Restarts

Keeper will not start a service which is currently stopped. We will only restart any actively running services after updating the log on credential.

When troubleshooting a service credential update issue, please make sure of the following:

• For a Windows server, ensure the operating system field is set to windows

• Ensure that the Keeper Gateway can communicate to the PAM Machine via WinRM or SSH.

• Check the Event Viewer > Windows Logs > Application events for any error messages

• Ensure that you are using a PAM Machine record to manage services and scheduled tasks.

Overview

In this guide, you'll learn how to rotate Linux user accounts within your local network using Keeper Rotation, including both password-based and SSH Key-based credentials. For a high-level overview on the rotation process in the local network, visit this .

Overview

In this guide, you'll learn how to rotate Local Postgres Database User and/or Admin accounts within your local network using Keeper Rotation. For a high-level overview on the rotation process in the local network, visit this .

Overview

In this guide, you'll learn how to rotate Local MongoDB User and/or Admin accounts within your local network using Keeper Rotation. For a high-level overview on the rotation process in the local network, visit this .

Overview

In this guide, you'll learn how to rotate Local MariaDB User and/or Admin accounts within your local network using Keeper Rotation. For a high-level overview on the rotation process in the local network, visit this .

Overview

In this guide, you'll learn how to rotate Local Oracle Database User and/or Admin accounts within your local network using Keeper Rotation. For a high-level overview on the rotation process in the local network, visit this .

Overview

In this guide, you'll learn how to rotate Windows user accounts within your local network using Keeper Rotation. For a high-level overview on the rotation process in the local network, visit this page.

Prerequisites

This guide assumes the following tasks have already taken place:

• Keeper Secrets Manager is enabled for your

• Keeper Rotation is enabled for your

• A Keeper Secrets Manager has been created

• A Keeper Rotation is already installed and showing online

1. Set up a PAM Machine Record

Keeper Rotation will use an admin credential to rotate credentials of other accounts in your local environment. These admin credentials need to have the sufficient permissions in order to successfully change the credentials of other accounts.

In this guide, we will store the admin credentials in a PAM Machine Record.

The following table lists all the required fields that needs to be filled on the PAM Machine Record with your information:

2. Set up a PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment.

If you are creating a new PAM Configuration, login to the Keeper Vault and select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration". The following table lists all the required fields on the PAM Configuration Record:

3. Set up one or more PAM User records

Keeper Rotation will use the credentials in the PAM Machine record to rotate the PAM User records on your Local environment. The PAM User credential needs to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

Supported Username Formats

Note that Keeper will attempt to login to the remote system using the username exactly as supplied. If authentication fails, Keeper will then attempt to use the below variations:

• User Principal Name (UPN) format: [email protected]

• Domain NetBIOS format: COMPANY\admin

• Shortened UPN format (no TLD): admin@company

• Domain FQDN with backslash format: company.com\admin

4. Configure Rotation on the PAM User records

Select the PAM User record(s) from Step 3, edit the record and open the "Password Rotation Settings".

• Select the desired schedule and password complexity.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• The "Resource Credential" field should select the PAM Machine credential setup from Step 1.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.

Service Management

Keeper can automatically update the Windows service account "log on as" credentials for any Windows services running as the PAM User, and restart the service. Keeper will also update the credential of any scheduled task running as that user on the target machine.

To learn more and set up this capability, see the page.

Overview

In this guide, you will learn how to rotate User Accounts of a Google Cloud Managed Microsoft AD service using Keeper Rotation. The Active Directory Service is an AWS managed resource where the Directory Service admin credentials are linked to the PAM Directory record type and the configurations of the AD Users are defined in the PAM User record type.

User Account passwords will be rotated using LDAP and, in order to successfully rotate, server-side LDAPS must be configured and the Directory Admin, defined in the PAM Directory record type, must be using a SSL Connection.

Prerequisites

This guide assumes the following tasks have already taken place:

• Keeper Secrets Manager is enabled for your

• Keeper Rotation is enabled for your

• A Keeper Secrets Manager has been created

• A Keeper Rotation is already installed, running, and is able to communicate with your Google Cloud Directory Services

1. Set up a PAM Directory Record

Keeper Rotation will use the linked admin credentials of your AWS Managed Directory Service to rotate passwords of Domain Service's directory accounts. These admin credentials can also be used to rotate the passwords of the Directory admin.

The following table lists all the required fields on the PAM Directory Record:

This PAM Directory Record with the admin credential needs to be in a shared folder that is shared to the KSM application created in the pre-requisites. Only the KSM application needs access to this privileged account, it does not need to be shared with any users.

2. Set up PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment.

In the left menu of the vault, select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration". The following table lists all the required fields on the PAM Configuration Record:

For more details on all the configurable fields in the PAM Configuration record, visit this .

3. Set up one or more PAM User Records

Keeper Rotation will use the credentials in the PAM Directory record to rotate the PAM User records on your GCP environment. The PAM User credential needs to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

4. Configure Rotation on the PAM User records

Select the PAM User record(s) from Step 3, edit the record and open the "Password Rotation Settings".

• Select the desired schedule and password complexity.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• The "Resource Credential" field should select the PAM Directory credential setup from Step 1.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.

Troubleshooting

Getting the Distinguished Names of GCP Managed Directory Service Users

The following windows command can be used to get the distinguished name of the Directory user:

If the command does not exist, you need to import the appropriate module with:

Overview

In this guide, you'll learn how to rotate Local MS SQL Server Database User and/or Admin accounts within your local network using Keeper Rotation. For a high-level overview on the rotation process in the local network, visit this page.

Prerequisites

This guide assumes the following tasks have already taken place:

• Keeper Secrets Manager is enabled for your

• Keeper Rotation is enabled for your

• A Keeper Secrets Manager has been created

• A Keeper Rotation is already installed, running, and is able to communicate to your MySQL database

1. Set up a PAM Database Record

Keeper Rotation will use an admin credential linked to the PAM Database to rotate credentials of other accounts in your local environment. These admin credentials need to have the sufficient permissions in order to successfully change the credentials of other accounts.

The following table lists all the required fields that needs to be filled on the PAM Database record with your information:

2. Set up a PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment.

If you are creating a new PAM Configuration, login to the Keeper Vault and select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration". The following table lists all the required fields on the PAM Configuration Record:

3. Set up one or more PAM User records

Keeper Rotation will use the credentials in the PAM Database record to rotate the PAM User records on your Local environment. The PAM User credential needs to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

4. Configure Rotation on the PAM User records

Select the PAM User record(s) from Step 3, edit the record and open the "Password Rotation Settings".

• Select the desired schedule and password complexity.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• The "Resource Credential" field should select the PAM Database credential setup from Step 1.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.

Overview

In this guide, you'll learn how to rotate passwords for AWS MySQL Database User and Admin accounts on your AWS environment using Keeper Rotation. RDS for MySQL is an AWS managed resource where the MySQL Admin Credentials are defined in the PAM Database record type and the configurations of the MySQL Users are defined in the PAM User record type.

For Amazon RDS, the AWS SDK will be used to rotate the password of Database Admin Accounts. To rotate the passwords of Regular Database Users, Keeper connects to the DB instance with the provided admin credentials and executes the necessary SQL statements to change the password.

Prerequisites

This guide assumes the following tasks have already taken place:

• Keeper Secrets Manager is enabled for your

• Keeper Rotation is enabled for your

• A Keeper Secrets Manager has been created

• A Keeper Rotation is already installed, running, and is able to communicate with your AWS MySQL Database

1. Set up PAM Database Records

The PAM Database record contains the admin credentials and necessary configurations to connect to the MySQL RDS instance on AWS. Keeper Rotation will use these provided configurations to rotate passwords of regular database user accounts in the MySQL RDS instance. These provided admin credentials need to also have sufficient database permissions to successfully change the credentials of the database user accounts.

The following table lists all the required fields on the PAM Database Record:

Note: Adding Provider Region and Database ID will enable managing the PAM Database Record through the SDK.

This PAM Database Record with the admin credential needs to be in a shared folder that is shared to the KSM application created in the pre-requisites. Only the KSM application needs access to this privileged account, it does not need to be shared with any users

2. Set up PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment.

If you are creating a new PAM Configuration, login to the Keeper Vault and select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration".

The following table lists all the required fields on the PAM Configuration Record:

For more details on all the configurable fields in the PAM Configuration record, visit this .

3. Set up PAM User Records

Keeper Rotation will use the credentials in the PAM Database record to rotate the PAM User records on your AWS environment. The PAM User credential needs to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

4. Configure Rotation on the PAM User records

Select the PAM User record(s) from Step 3, edit the record and open the "Password Rotation Settings".

• Select the desired schedule and password complexity.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• The "Resource Credential" field should select the PAM Database credential setup from Step 1.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.

Overview

In this guide, you'll learn how to rotate Local MySQL Database User and/or Admin accounts within your local network using Keeper Rotation. For a high-level overview on the rotation process in the local network, visit this page.

Prerequisites

This guide assumes the following tasks have already taken place:

• Keeper Secrets Manager is enabled for your

• Keeper Rotation is enabled for your

• A Keeper Secrets Manager has been created

• A Keeper Rotation is already installed, running, and is able to communicate to your MySQL database

1. Set up a PAM Database Record

Keeper Rotation will use an admin credential linked from the PAM Database record to rotate credentials of other accounts in your local environment. These admin credentials need to have the sufficient permissions in order to successfully change the credentials of other accounts.

The following table lists all the required fields that needs to be filled on the PAM Database Record with your information:

2. Set up a PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment.

If you are creating a new PAM Configuration, login to the Keeper Vault and select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration". The following table lists all the required fields on the PAM Configuration Record:

3. Set up PAM User records

Keeper Rotation will use the credentials in the PAM Database record to rotate the PAM User records on your Local environment. The PAM User credential needs to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

4. Configure Rotation on the PAM User records

Select the PAM User record(s) from Step 3, edit the record and open the "Password Rotation Settings".

• Select the desired schedule and password complexity.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• The "Resource Credential" field should select the PAM Database credential setup from Step 1.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.

Overview

In this guide, you'll learn how to rotate passwords for Google Cloud SQL Server Database User and Admin accounts on your Google Cloud environment using Keeper Rotation. Cloud SQL for SQL Server is an GCP managed resource where the SQL Server Admin Credentials are defined in the PAM Database record type and the configurations of the SQL Server Users are defined in the PAM User record type.

To rotate the passwords of Regular Database Users, Keeper connects to the DB instance with the provided admin credentials and executes the necessary SQL statements to change the password.

Prerequisites

This guide assumes the following tasks have already taken place:

• Keeper Secrets Manager is enabled for your

• Keeper Rotation is enabled for your

• A Keeper Secrets Manager has been created

• A Keeper Rotation is already installed, running, and is able to communicate with your GCP SQL Server Database

1. Set up a PAM Database Record

The PAM Database record contains the admin credentials and necessary configurations to connect to the SQL Server Cloud SQL instance on GCP. Keeper Rotation will use these provided configurations to rotate passwords of regular database user accounts in the SQL Server Cloud SQL instance. These provided admin credentials need to also have sufficient database permissions to successfully change the credentials of the database user accounts.

The following table lists all the required fields on the PAM Database Record:

This PAM Database Record with the admin credential needs to be in a shared folder that is shared to the KSM application created in the pre-requisites. Only the KSM application needs access to this privileged account, it does not need to be shared with any users

2. Set up PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment.

In the left menu of the vault, select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration". The following table lists all the required fields on the PAM Configuration Record:

For more details on all the configurable fields in the PAM Configuration record, visit this .

3. Set up PAM User Records

Keeper Rotation will use the credentials in the PAM Database record to rotate the PAM User records on your GCP environment. The PAM User credential needs to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

4. Configure Rotation on the PAM User records

Select the PAM User record(s) from Step 3, edit the record and open the "Password Rotation Settings".

• Select the desired schedule and password complexity.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• The "Resource Credential" field should select the PAM Database credential setup from Step 1.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.

Overview

In this guide, you'll learn how to rotate passwords for AWS MariaDB Database User and Admin accounts on your AWS environment using Keeper Rotation. RDS for MariaDB is an AWS managed resource where the MariaDB Admin Credentials are defined in the PAM Database record type and the configurations of the MySQL Users are defined in the PAM User record type.

For Amazon RDS, the AWS SDK will be used to rotate the password of Database Admin Accounts. To rotate the passwords of Regular Database Users, Keeper connects to the DB instance with the provided admin credentials and executes the necessary SQL statements to change the password.

Prerequisites

This guide assumes the following tasks have already taken place:

• Keeper Secrets Manager is enabled for your

• Keeper Rotation is enabled for your

• A Keeper Secrets Manager has been created

• A Keeper Rotation is already installed, running, and is able to communicate with your AWS MariaDB Database

1. Set up PAM Database Record

The PAM Database record contains the admin credentials and necessary configurations to connect to the MariaDB RDS instance on AWS. Keeper Rotation will use these provided configurations to rotate passwords of regular database user accounts in the MariaDB RDS instance. These provided admin credentials need to also have sufficient database permissions to successfully change the credentials of the database user accounts.

The following table lists all the required fields on the PAM Database Record:

Note: Adding Provider Region and Database ID will enable managing the PAM Database Record through the SDK.

This PAM Database Record with the admin credential needs to be in a shared folder that is shared to the KSM application created in the pre-requisites. Only the KSM application needs access to this privileged account, it does not need to be shared with any users

2. Set up PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment.

If you are creating a new PAM Configuration, login to the Keeper Vault and select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration".

The following table lists all the required fields on the PAM Configuration Record:

For more details on all the configurable fields in the PAM Configuration record, visit this .

3. Set up PAM User Records

Keeper Rotation will use the credentials in the PAM Database record to rotate the PAM User records on your AWS environment. The PAM User credential needs to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

4. Configure Rotation on the PAM User records

Select the PAM User record(s) from Step 3, edit the record and open the "Password Rotation Settings".

• Select the desired schedule and password complexity.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• The "Resource Credential" field should select the PAM Database credential setup from Step 1.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.

Overview

In this guide, you'll learn how to rotate passwords for GCP PostgreSQL Database User and Admin accounts on your Google Cloud environment using Keeper Rotation. Cloud SQL for PostgreSQL is a GCP managed resource where the PostgreSQL Admin Credentials are defined in the PAM Database record type and the configurations of the PostgreSQL Users are defined in the PAM User record type.

To rotate the passwords of Regular Database Users, Keeper connects to the DB instance with the provided admin credentials and executes the necessary SQL statements to change the password.

Prerequisites

This guide assumes the following tasks have already taken place:

• Keeper Secrets Manager is enabled for your

• Keeper Rotation is enabled for your

• A Keeper Secrets Manager has been created

• A Keeper Rotation is already installed, running, and is able to communicate with your GCP PostgreSQL Database

1. Set up a PAM Database Record

The PAM Database record contains the admin credentials and necessary configurations to connect to the PostgreSQL Cloud SQL instance on GCP. Keeper Rotation will use these provided configurations to rotate passwords of regular database user accounts in the PostgreSQL Cloud SQL instance. These provided admin credentials need to also have sufficient database permissions to successfully change the credentials of the database user accounts.

The following table lists all the required fields on the PAM Database Record:

This PAM Database Record with the admin credential needs to be in a shared folder that is shared to the KSM application created in the pre-requisites. Only the KSM application needs access to this privileged account, it does not need to be shared with any users

2. Set up PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment.

In the left menu of the vault, select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration". The following table lists all the required fields on the PAM Configuration Record:

For more details on all the configurable fields in the PAM Configuration record, visit this .

3. Set up PAM User Records

Keeper Rotation will use the credentials in the PAM Database record to rotate the PAM User records on your GCP environment. The PAM User credential needs to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

4. Configure Rotation on the PAM User records

Select the PAM User record(s) from Step 3, edit the record and open the "Password Rotation Settings".

• Select the desired schedule and password complexity.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• The "Resource Credential" field should select the PAM Database credential setup from Step 1.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.

Overview

In this guide, you will learn how to rotate passwords for Google Workspace users. In Keeper, the PAM Configuration contains all of the information needed to rotate passwords. The record containing the Google Principal user accounts to be rotated are stored in the PAM User record.

Prerequisites

This guide assumes the following tasks have already taken place:

• Keeper Secrets Manager is enabled for your

• Keeper Rotation is enabled for your

• A Keeper Secrets Manager has been created

• A Keeper Rotation is already installed and running

The Keeper Gateway uses Google Admin APIs to rotate the credentials defined in the PAM User records.

1. Create Shared Folder

In this folder, you’ll create records for the Google Principal accounts that you’ll rotate. You will create a PAM User record for each user that will be rotated.

Keeper Rotation uses the Google Admin API to rotate the PAM User records in your Google Workspace environment. The PAM User records need to be in a shared folder that is shared to the KSM application created in the prerequisites.

The following table lists all the required fields on the PAM User record:

3. Set up PAM Configuration

Note: You can skip this step if you already have a PAM Configuration set up for this environment.

In the left menu of the vault, select "Secrets Manager", then select the "PAM Configurations" tab, and click on "New Configuration". The following table lists all the required fields on the PAM Configuration Record:

For more details on all the configurable fields in the PAM Configuration record, visit this .

4. Configure Rotation on the PAM User Records

Select the PAM User record(s) from Step 2, edit the record and open the "Password Rotation Settings".

• Select "IAM User" as the rotation method, since this uses Google Admin APIs.

• The "Rotation Settings" should use the PAM Configuration setup previously.

• Select the desired schedule and password complexity.

• Upon saving, the rotation button will be enabled and available to rotate on demand, or via the selected schedule.

Any user with edit rights to a PAM User record has the ability to setup rotation for that record.

Overview

In this guide, you will learn how to rotate passwords for Azure AD users. In Keeper, the contains all of the information needed to rotate passwords. The record containing the Azure AD user accounts to be rotated are stored in the PAM User record.

The Keeper Gateway uses Azure APIs to rotate the credentials defined in the PAM User records.

Overview

In this guide, you'll learn how to rotate passwords for AWS Oracle Database User and Admin accounts on your AWS environment using Keeper Rotation. RDS for Oracle is an AWS managed resource where the Oracle Admin Credentials are defined in the PAM Database record type and the configurations of the MySQL Users are defined in the PAM User record type.

For Amazon RDS, the AWS SDK will be used to rotate the password of Database Admin Accounts. To rotate the passwords of Regular Database Users, Keeper connects to the DB instance with the provided admin credentials and executes the necessary SQL statements to change the password.

Overview

In this guide, you will learn how to rotate passwords for AWS IAM users. In Keeper, the PAM Configuration contains all of the information needed to rotate passwords. The record containing the AWS IAM user accounts to be rotated are stored in the PAM User record.

Overview

In this guide, you'll learn how to rotate passwords for Google Cloud MySQL Database User and Admin accounts on your GCP environment using Keeper Rotation. Cloud SQL for MySQL is an GCP managed resource where the MySQL Admin Credentials are defined in the PAM Database record type and the configurations of the MySQL Users are defined in the PAM User record type.

To rotate the passwords of Regular Database Users, Keeper connects to the DB instance with the provided admin credentials and executes the necessary SQL statements to change the password.