PAM Training Series · Module Guide

Privileged Access
Management

A hands-on guide covering credential injection, granular access control, checkout hooks, and expiration alerting — the four pillars of secure privileged access.

🔐

Credential Injection to Target

Seamlessly deliver secrets, passwords, and tokens directly to target systems without exposing them to human operators — eliminating credential sprawl and manual copy-paste workflows that introduce risk.

👁️

Zero-Knowledge Delivery

Credentials are injected at runtime. Operators never see the actual secret — only the session and outcome are visible.

Automated Propagation

Secrets vault → target in milliseconds. No manual copy, no clipboard exposure, no human-in-the-loop for routine access.

🛡️

Audit Trail Intact

Every injection event is logged with timestamp, user, session ID, and target — full chain of custody without friction.

🔗

Protocol Coverage

Supports SSH, RDP, HTTP/S APIs, database connections, and custom connectors via the plugin SDK.

credential-injection-flow.diagram — click nodes to explore
Vault
Secret stored
PAM Engine
Auth request
Policy Check
RBAC / ABAC
Injection Proxy
In-memory
Target System
Session open
Vault — The credential is stored encrypted at rest. The plaintext secret never leaves the vault boundary unencrypted.
how-it-works.steps
1
User initiates access request
The operator requests a session to a target (e.g., a production database or server). They select the target from the catalog — no credentials are displayed at this stage. The request triggers the PAM workflow.
2
Vault retrieves and decrypts secret
The PAM engine queries the secrets vault using the target's binding. The vault decrypts the credential in a protected memory region — this value never touches disk or logs.
3
Injection proxy establishes session
A transparent proxy opens a privileged session to the target on behalf of the user, injecting the credential at the protocol layer (e.g., SSH handshake, RDP login packet, JDBC connection string).
4
User receives session, credential stays hidden
The user gets a fully authenticated session on the target system. They can work normally — run commands, query databases — but the underlying credential was never visible in their browser, terminal, or clipboard.
✦ Knowledge Check — What is the primary security benefit of credential injection to target?
A
It stores credentials in the browser's local storage for fast access
B
Credentials are never exposed to the human operator, reducing exfiltration risk
C
It removes the need for a vault entirely
D
It encrypts the session transcript after the fact
✓ Correct — by injecting at the protocol layer, operators authenticate to targets without ever seeing the secret. Even a compromised workstation cannot expose what was never visible.
🎛️

Granular Access Control

Move beyond all-or-nothing permission models. Define precisely who can access which credential, on which target, at which time — with attribute-based and role-based controls working in concert.

🏷️

Attribute-Based Policies

Combine user attributes (team, clearance level, geo) with resource attributes (environment, sensitivity) for dynamic, context-aware decisions.

📅

Time-Windowed Access

Grant access only during maintenance windows, business hours, or specific incident response periods. Access automatically lapses outside the window.

🗂️

Just-In-Time Provisioning

No standing privileges. Access is granted on demand, used, then revoked — shrinking the blast radius of any compromise.

🔍

Per-Command Filtering

Restrict what actions are permitted within a session. Allow read-only queries, block destructive commands — all enforced at the proxy layer.

access-matrix.live — interactive policy table
Role Target Environment Access Type Time Window Status
db-admin prod-postgres-01 PROD READ/WRITE Mon–Fri 09:00–18:00 ● ACTIVE
sre-on-call prod-k8s-cluster PROD READ ONLY 24/7 on-call rotation ● ACTIVE
dev-team staging-db-cluster STAGING READ/WRITE Unrestricted ● ACTIVE
contractor-ext prod-api-server PROD READ ONLY Project window only ✕ EXPIRED
auditor all-targets ALL AUDIT LOGS Quarterly audit period ◑ PENDING
pam-cli — policy evaluation trace
$pam access-check --user alice --target prod-postgres-01 --time "2024-03-12T14:30:00Z"
Evaluating policy for: alice@eng.corp
→ Role bindings: ["db-admin", "dev-team"]
→ Target tags: env=prod, tier=data, sensitivity=high
→ Current time: Tuesday 14:30 UTC (within Mon–Fri 09:00–18:00)
→ MFA verified: true
→ Geo-fence: PASS (US-WEST-2)
 
✓ ACCESS GRANTED
Session TTL: 4h · Checkout token: ck_9f2a...d831
✦ Knowledge Check — What does Just-In-Time (JIT) access provisioning primarily reduce?
A
The number of roles that need to be defined
B
Audit log storage requirements
C
Standing privileges — limiting the blast radius of a compromised account
D
The speed of credential rotation
✓ Correct — JIT removes persistent access entitlements. A compromised account with no standing privileges gives an attacker nothing useful until the next legitimate checkout, which can be challenged or blocked.
🪝

Hooks on Checkout with Elevated Permissions

Trigger automated workflows at the moment a privileged credential is checked out. Enforce approvals, spin up MFA challenges, create change tickets, or notify secondary responders — all without adding friction to legitimate workflows.

Pre-Checkout Approval Gates

Require manager sign-off or peer approval for highly sensitive targets before the credential is released. Dual-control at the moment of access.

🔔

Automated Ticket Creation

Automatically open a change or incident record in ServiceNow, Jira, or PagerDuty and bind the PAM session to it for full traceability.

📣

Real-Time Slack / Teams Notify

Alert team leads or security channels the instant a root-level or domain-admin checkout occurs. No one works in the dark.

🔄

Post-Checkin Cleanup Hooks

On session end: rotate the credential automatically, revoke temporary firewall rules, and close the bound change ticket — all triggered by the checkin event.

hooks.config.yaml — elevated checkout example
# PAM Hook Configuration — Elevated Checkout hooks: on_checkout: conditions: target_sensitivity: "critical" role_is_elevated: true actions: # 1. Require dual approval before credential release - type: approval_gate approvers: ["security-team", "manager"] timeout_minutes: 15 escalate_on_timeout: true # 2. Push MFA challenge to operator - type: mfa_challenge methods: ["totp", "hardware_key"] # 3. Open change ticket in ServiceNow - type: webhook url: "https://your-org.service-now.com/api/pam/change" bind_session_id: true # 4. Notify security Slack channel - type: notify channel: "#security-alerts" message: "Elevated checkout: {{user}} → {{target}} at {{timestamp}}" on_checkin: actions: - type: rotate_credential immediate: true - type: close_ticket resolution: "Session ended normally. Credential rotated."
checkout-lifecycle.interactive — click a stage
Request
User initiates
Policy Eval
ABAC check
Hook: Approval
Dual-control
Hook: MFA
Step-up auth
Credential
Injected
Hook: Checkin
Rotate + close
Request — The user selects a target system. The checkout request is queued. No credential access yet.
✦ Knowledge Check — When should a post-checkin hook typically rotate the credential?
A
Only when the session ended in an error
B
Only for external contractor sessions
C
After every elevated session, immediately upon checkin
D
On a nightly batch schedule regardless of sessions
✓ Correct — rotating immediately after every elevated session ensures the credential is valid for exactly one use period. Even if the session was recorded or intercepted, the credential is already dead by the time it could be replayed.

Alerting on Credential Expiration

Never let a forgotten credential become a silent vulnerability. Proactive multi-tier alerting ensures the right people are notified at the right time — with enough runway to rotate before an outage or audit finding.

📊

Tiered Alert Thresholds

Configure multi-stage warnings: 30-day early notice → 7-day urgency → 24-hour critical → on-expiry hard block with escalation.

📨

Multi-Channel Delivery

Route alerts to email, Slack, PagerDuty, SIEM, or custom webhooks. Different channels for different severity tiers.

🤖

Auto-Rotation Option

Optionally trigger automatic rotation at configurable thresholds — zero-touch renewal that completes before humans need to act.

📈

Compliance Dashboard

Real-time visibility into the expiration posture of your entire credential inventory — aging heatmaps, overdue counts, and SLA tracking.

credential-posture.live — expiration monitor
alert-feed.live — expiration notifications
CRITICAL — Credential Expired

prod-db-root · vault/prod/database/root · Expired 6 hours ago. Access blocked. Auto-rotation queued.

CRITICAL
6h ago
WARNING — Expires in 3 Days

k8s-service-account · vault/prod/k8s/sa-token · Rotation recommended. Owner: platform-team.

HIGH
1h ago
WARNING — Expires in 5 Days

aws-iam-deploy · vault/prod/aws/deploy-key · Ticket #CHG-4821 auto-created in ServiceNow.

MEDIUM
3h ago
INFO — Expires in 18 Days

github-deploy-key · vault/ci/github/deploy · Early notice. No action required yet.

LOW
12h ago
INFO — Auto-Rotation Completed

staging-postgres-admin · vault/staging/db/admin · Rotated successfully. New TTL: 90 days.

OK
2d ago
✦ Knowledge Check — Why is a multi-tier expiration alert system (30d → 7d → 24h) better than a single alert?
A
It generates more SIEM events for compliance reports
C
It gives progressive lead time so teams can schedule rotation without emergency scrambles
B
It reduces the total number of credentials that need managing
D
Single alerts are delayed by email infrastructure so tiers compensate
✓ Correct — tiered alerting lets teams plan ahead. An early 30-day notice allows change board scheduling; the 7-day warning escalates urgency; the 24-hour critical ensures on-call is activated. Each tier serves a different stakeholder and process rhythm.

🎉 Training Complete

You've covered all four modules — credential injection, granular access, checkout hooks, and expiration alerting. You're ready to configure and operate a PAM deployment.