# PAM Configuration

<figure><img src="/files/Bs8GXsJMoF8rGMuAB7Yj" alt=""><figcaption></figcaption></figure>

## Overview

In Keeper, the **PAM Configuration** contains essential information of your target infrastructure, settings and associated Keeper Gateway. We recommend setting up one PAM Configuration for each Gateway and network being managed.

## Creating PAM Configuration

To create a new PAM Configuration:

* Login to the Keeper Vault
* Select Secrets Manager and the "PAM Configurations" tab
* Click on "New Configuration"

## PAM Configuration Fields

When setting up the PAM Configuration, you have the option of choosing one of the following environments:

* [Local Network](#local-network-environment)
* [AWS](#aws-environment)
* [Azure](#aws-environment)
* [Google Cloud](#google-cloud-environment)
* [Domain Controller](#domain-controller-environment)

The following tables provides more details on each configurable fields in the PAM Configuration record regardless of the environment you choose:

<table><thead><tr><th width="207.33333333333331">Field</th><th>Description</th><th>Notes</th></tr></thead><tbody><tr><td>Title</td><td>Name of PAM configuration record</td><td>Ex: <code>US-EAST-1 Config</code></td></tr><tr><td>Gateway</td><td>The configured gateway</td><td>See <a href="/pages/YVitXRsJWzo14VlLdwoR">docs</a> for more info</td></tr><tr><td>Application Folder</td><td>The shared folder where the PAM Configuration data will be stored</td><td>Best practice is to create a folder with limited access to admins. See Security Note (1) below</td></tr><tr><td>PAM Settings</td><td>List of Zero-Trust KeeperPAM features that should be enabled</td><td>See <a href="#pam-features-on-pam-configuration">this section</a> for more info</td></tr><tr><td>Default Rotation Schedule</td><td>Specify frequency of Rotation</td><td>Ex: <code>Daily</code></td></tr><tr><td>Port Mapping</td><td>Define alternative default ports</td><td>Ex: <code>3307=mysql</code><br>See <a href="/pages/Ax7er5mBNVgdfkFoyybz">port mapping</a> docs</td></tr></tbody></table>

{% hint style="danger" %}
**Security Note (1)**\
\
The PAM Configuration information is stored as a record in the vault inside the specified **Application Folder** and may contain secrets. Therefore, we recommend that the Application Folder should be limited in access to only privileged admins.
{% endhint %}

The following tables provides more details on each configurable fields in the PAM Network Configuration record based on the environment you chose:

### Local Network Environment

<table><thead><tr><th width="212">Field</th><th width="251">Description</th><th width="282">Notes</th></tr></thead><tbody><tr><td>Network ID</td><td>Unique ID for the network</td><td><p>This is for the user's reference</p><p>Ex: <code>My Network</code></p></td></tr><tr><td>Network CIDR</td><td>Subnet of the IP address</td><td>Ex: <code>192.168.0.15/24</code><br>Refer to <a href="https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing">this </a>for more info</td></tr></tbody></table>

### AWS Environment

<table><thead><tr><th width="195">Field</th><th width="318">Description</th><th>Notes</th></tr></thead><tbody><tr><td>AWS ID</td><td>A unique id for the instance of AWS</td><td>Required, This is for the user's reference<br>Ex: <code>AWS-US-EAST-1</code></td></tr><tr><td>Access Key ID</td><td>From an IAM user account, the Access key ID from the desired Access key.</td><td>Leave Empty when EC2 instance role is assumed.</td></tr><tr><td>Secret Access Key</td><td>The secret key for the access key.</td><td>Leave Empty when EC2 instance role is assumed.</td></tr><tr><td>Region Names</td><td>AWS region names used for discovery. Separate newline per region</td><td>Ex:<br>us-east-2<br>us-west-1</td></tr><tr><td>Port Mapping</td><td>Any non-standard ports referenced. Separate newline per entry</td><td>Ex:<br>2222=ssh<br>3390=rdp</td></tr></tbody></table>

* See additional information on [AWS Environment Setup](/keeperpam/privileged-access-manager/getting-started/pam-configuration/aws-environment-setup.md)

### Azure Environment

<table><thead><tr><th width="185">Field</th><th width="352">Description</th><th>Notes</th></tr></thead><tbody><tr><td>Azure ID</td><td>A unique id for your instance of Azure</td><td>Required, This is for the user's reference<br>Ex: <code>Azure-1</code></td></tr><tr><td>Client ID</td><td>The application/client id (UUID) of the Azure application</td><td>Required</td></tr><tr><td>Client Secret</td><td>The client credentials secret for the Azure application</td><td>Required</td></tr><tr><td>Subscription ID</td><td>The UUID of the subscription (i.e. Pay-As-You-GO).</td><td>Required</td></tr><tr><td>Tenant ID</td><td>The UUID of the Azure Active Directory</td><td>Required</td></tr><tr><td>Resource Groups</td><td>A list of resource groups to be checked. If left blank, all resource groups will be checked. Newlines should separate each resource group.</td><td></td></tr></tbody></table>

* See additional information on [Azure Environment Setup](/keeperpam/privileged-access-manager/getting-started/pam-configuration/azure-environment-setup.md)

### Google Cloud Environment

<table><thead><tr><th width="195">Field</th><th width="282.8515625">Description</th><th>Notes</th></tr></thead><tbody><tr><td>GCP ID</td><td>A unique id for the instance of Google Cloud</td><td>Required, This is for the user's reference. Example:<br><code>GCP-US-CENTRAL1</code></td></tr><tr><td>Google Workspace Administrator Email</td><td>The email address for a Google Workspace administrator account that can be used to manage passwords for GCP Principals.</td><td>Leave Empty if no such account exists, or if the environment does not require Principal rotation.</td></tr><tr><td>Service Account Key</td><td>The service account key in JSON format.</td><td><p>Required. Example:</p><pre class="language-json"><code class="lang-json">{
  "type": "service_account",
  "project_id": "&#x3C;project-id>",
  "private_key_id": "&#x3C;private-key-id>",
  "private_key": "&#x3C;private-key>",
  "client_email": "&#x3C;client-email>",
  "client_id": "&#x3C;client-id>",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/&#x3C;app-identifier>.iam.gserviceaccount.com"
}
</code></pre></td></tr><tr><td>Region Names</td><td>AWS region names used for discovery. Separate newline per region</td><td>Example:<br>us-east4<br>us-south1</td></tr><tr><td>Port Mapping</td><td>Any non-standard ports referenced. Separate newline per entry</td><td>Example:<br>2222=ssh<br>3390=rdp</td></tr></tbody></table>

* See additional information on [Google Cloud Environment Setup](/keeperpam/privileged-access-manager/getting-started/pam-configuration/google-cloud-environment-setup.md)

### Domain Controller Environment

| Field                     | Description                                                                                                                                        | Required |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| Administrative Credential | Credentials of a domain administrator or an account with equivalent privileges, required to perform full discovery and access all domain resources | Yes      |
| Hostname and Port         | Hostname and port for the domain controller.                                                                                                       | Yes      |
| Domain ID                 | The FQDN domain used by the Domain Controller. For example, EXAMPLE.COM and not EXAMPLE.                                                           | Yes      |
| Use SSL                   | If using LDAPS (default 636), check the box. If using LDAP (default 389), uncheck the box.                                                         | Yes      |
| Scan Network              | Scan the CIDRs from the domain controller. Default to False.                                                                                       | No       |
| Network CIDR              | Scan additional CIDRs from the field.                                                                                                              | No       |
| Port Mapping              | Define alternative default ports                                                                                                                   | No       |

## PAM Features on PAM Configuration

The **"PAM Features Allowed"** and **"Session Recording Types Allowed"** sections in the PAM Configuration allow owners to enable or disable KeeperPAM features for resources managed through the PAM configuration:

<table><thead><tr><th width="353">Field</th><th>Description</th></tr></thead><tbody><tr><td>Rotation</td><td>If enabled, allow rotations on privileged user users managed by this PAM configuration</td></tr><tr><td>Connections</td><td>If enabled, allow connections on resources managed by this PAM configuration</td></tr><tr><td>Remote Browser Isolation (RBI)</td><td>If enabled, allow RBI sessions on resources managed by this PAM configuration</td></tr><tr><td>Tunneling</td><td>If enabled, allow tunnels on resources managed by this PAM configuration</td></tr><tr><td>Graphical Session Recording</td><td>If enabled, visual playback sessions will be recorded for all connections and RBI sessions</td></tr><tr><td>Text Session Recording (TypeScript)</td><td>If enabled, text input and output logs will be logged for all connections and RBI sessions</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/privileged-access-manager/getting-started/pam-configuration.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.