PAM Cloud

KeeperPAM resource for managing access to cloud platforms through cloud identity platforms

Overview

A PAM Cloud record is a type of KeeperPAM resource that represents a way to access cloud platform environments, such as an AWS account, Azure tenant, or GCP console. It also enables access to platforms that use a cloud identity provider (such as Snyk, Box, GitHub, etc...) to provide SAML and SCIM access to those platforms. Access can be granted through Just-In-Time (JIT) user elevation, and the record enables Remote Browser Isolation (RBI) access when permissions are granted.

PAM Record Type

Supported Assets

PAM Cloud

AWS, GCP, Azure, and any application that uses SAML or SCIM from AWS IAM and Identity Center, Azure Entra ID, GSuite, Okta, and Active Directory.

Accessing a Resource After Elevation

Once access has been approved, users can access the target resource using either Keeper's Remote Browser Isolation (RBI) capability or their organization's standard authentication workflow. When using RBI, the user launches the protected web application directly from the Keeper Vault, providing secure, isolated browser access without exposing credentials or requiring direct connectivity from the user's device.

Alternatively, users may access the platform using the same login methods they normally use. For example, AWS IAM Identity Center users can sign in through their standard AWS access portal (Start URL), while users of AWS CLI, Terraform, or other SDK-based tools can authenticate through their existing workflows. Because KeeperPAM has temporarily elevated the user's privileges, the user will be able to select or assume the authorized elevated role during the approved access window. When the access duration expires, the elevated privileges are automatically removed.

Remote Browser Isolation

When using RBI for accessing the cloud resource, PAM Cloud records provide a Remote Browser "Launch" capability which loads internal and cloud-based web applications through a protected browser, embedded within the vault. This browser is projected visually from the Keeper Gateway through the Keeper Vault, isolating the session and providing zero-trust access.

Features Available

The PAM Cloud resource supports the following features:

Privilege Elevation of any cloud resource through Workflow and Just-In-Time (JIT) elevation
Zero-trust Connections over http:// and https:// websites through RBI
Support for AWS, Azure, GCP, Okta and more
Sharing cloud access without sharing credentials

Connecting to the protected web application requires only that the Keeper Gateway has access to the target website. The Keeper Vault operates independently and does not require direct connectivity to the website, leveraging Keeper's zero-trust network access model to securely manage access through the Gateway. See the network architecture diagram for more details.

Creating a Cloud Record

Prior to creating a PAM Cloud Record, make sure you have already created a PAM Configuration. The PAM Configuration contains information of your target infrastructure while the PAM Cloud record contains information about the target cloud platform and associated access rules.

To create a PAM Cloud Resource:

Click on Create New
Select "Connection"
On the prompted window:
- Select "New Record"
- Select the Shared Folder you want the record to be created in
- Specify the Title
- Select "Cloud Resource" for the Target
Click "Next" and complete all of the required information.