Module 01
/
Privileged Access Management
Module 01 Foundations
Privileged
Access Management
What PAM is, why it matters, and the foundational controls that protect your most sensitive access paths — the essential building block before exploring cloud entitlements.
🎯
Learning Objective
Understand what privileged access is, why it's the primary target in virtually every breach, and how core PAM controls reduce that risk.
🔑
What is Privileged Access?
The definition that drives everything

Privileged access describes any account, credential, or permission that grants elevated rights beyond a standard user — the ability to modify system configurations, access sensitive data en masse, install software, or make changes that affect entire environments. In cloud contexts, this extends to IAM roles that can create or destroy infrastructure.

74%
of breaches involve privileged credential abuse
3×
more expensive when privileged access is involved
80%
of cloud security failures are due to misconfigured IAM
Core PAM Controls
🏦
Credential Vaulting & Password Management
▼
Privileged credentials are stored in an encrypted, access-controlled vault — never in spreadsheets, scripts, or shared drives. Users check out credentials for a session; passwords are rotated automatically afterward. This enforces no shared static passwords and a complete audit trail of who accessed what, when, and from where.
🖥️
Privileged Session Management (PSM)
▼
All privileged sessions — RDP, SSH, database connections, cloud console access — are proxied through a session management layer. Sessions are recorded, monitored in real time, and can be terminated instantly. Keystroke logging and video capture provide forensic evidence and satisfy compliance requirements including SOX, PCI-DSS, and HIPAA.
📏
Least Privilege & Just-In-Time (JIT) Access
▼
Least privilege ensures accounts only hold the minimum permissions necessary for their role. Just-In-Time (JIT) access goes further: privilege is granted only for the duration of a specific, approved task, then automatically revoked. This eliminates "standing privilege" — accounts that always have admin rights even when not actively using them — dramatically shrinking the attack surface. In cloud environments, this translates to temporary role assumption rather than permanent IAM role assignments.
🔄
Privileged Access Workflows & Governance
▼
PAM solutions enforce approval workflows: privileged access requests require justification, manager approval, and time-boxing. This creates a governance layer that satisfies auditors, provides a full change record, and ensures that every privileged action is intentional and authorized. Integration with ITSM tools like ServiceNow links every privileged session to a change ticket.
☁️
PAM in the Cloud Era
Traditional PAM was built for on-premises systems with clear perimeters. Cloud has fundamentally changed the game: IAM roles, service principals, and cloud entitlements are the new privileged accounts — and they require cloud-native PAM capabilities like Delinea PCCE to manage them effectively.
✅
Module Complete
You've covered PAM fundamentals. Continue to explore the cloud identity threat landscape.
Module 02 Cloud Context
Identity Security
in the Cloud
How cloud adoption transformed the identity threat landscape — and why cloud IAM has become the most targeted attack surface in modern enterprises.
🌩️
The Cloud Shift
In cloud environments, identity IS infrastructure. A misconfigured IAM role doesn't just expose data — it can allow an attacker to spin up compute, exfiltrate entire S3 buckets, move laterally across accounts, or persist access indefinitely through backdoor roles.
👤
Human Cloud Identities

Developers, DevOps engineers, cloud architects, and data scientists who directly access cloud consoles and CLIs. Each typically has far more permissions than needed — because cloud IAM policies are often written for convenience, not least privilege.

Cloud Console Users Developers Data Scientists
🤖
Non-Human Cloud Identities

Applications, Lambda functions, containers, CI/CD pipelines, and automation that authenticate to cloud services. These outnumber human identities by 10–50× and are frequently granted overly broad permissions for development convenience that is never revisited.

Service Principals Lambda Roles Managed Identities API Keys
☁️ The Multi-Cloud Identity Surface — Click to explore
Each cloud platform has its own identity model with unique risks and blind spots
🟠
AWS IAM
Users, roles, policies, trust relationships
🔵
Azure / Entra ID
Service principals, managed identities, RBAC
🟢
Google Cloud
Service accounts, IAM bindings, workload identity
📦
SaaS & PaaS
GitHub, Snowflake, Salesforce org admins
⬆ Click a cloud platform above to see its identity risks and key entitlement types
Cloud Identity Attack Chain
🎣
Initial Access
Phishing / leaked
API key / SSRF
🔍
Enumeration
IAM permissions
discovery (Pacu, ScoutSuite)
📈
Privilege Escalation
Assume overprivileged
role / pass-role abuse
🌍
Lateral Movement
Cross-account trust
STS AssumeRole abuse
💥
Impact
Data exfiltration
crypto-mining / ransomware
Cloud Attack VectorDescriptionPCCE Control
Pass-Role Abuse Attacker with iam:PassRole assigns a high-privilege role to a resource they control Entitlement analysis, least privilege enforcement
Assume-Role Chaining Escalating privileges by hopping through trusted roles across accounts Cross-account trust mapping, anomaly detection
Unused Access Keys Long-lived programmatic keys that are leaked or stolen and used months later Continuous discovery, auto-rotation workflows
Misconfigured IAM Policies Wildcard actions (*) or wildcard resources (*) granting unintended permissions Policy analysis, right-sizing recommendations
Shadow Service Accounts GCP / Azure identities created by developers that security teams don't know about Continuous multi-cloud identity discovery
✅
Module Complete
You understand the cloud identity threat landscape. Next: the specific challenge of cloud entitlements.
Module 03 CIEM
Cloud Entitlements
& The CIEM Gap
Understanding the permissions explosion in cloud environments, why traditional PAM doesn't solve it, and what Cloud Infrastructure Entitlement Management (CIEM) addresses.
⚡
The Permissions Explosion
AWS alone has over 15,000 individual IAM permissions. A typical enterprise cloud environment has millions of active permission grants across hundreds of roles and thousands of resources — impossible to audit manually, and almost always over-provisioned by a factor of 10× or more.
95%
of cloud permissions are never used (Gartner)
15K+
individual IAM permissions in AWS alone
10×
average over-provisioning ratio in cloud IAM
📋
What is a Cloud Entitlement?
The unit of cloud access control

A cloud entitlement is any permission grant that allows an identity (human or non-human) to perform an action on a cloud resource. This includes IAM policies in AWS, RBAC role assignments in Azure, IAM bindings in GCP, and equivalent constructs in SaaS platforms. Entitlements can be direct (assigned to a user) or indirect (through group, role, or policy inheritance).

Why Entitlements Become a Security Problem
🌊
Entitlement Sprawl
▼
Permissions accumulate over time through a pattern of expansion but no contraction: a developer needs access to debug an issue → they get a broad role → the role is never removed or scoped down → it's copied when provisioning the next developer → repeat. Over months, every identity in the environment has access to far more than they need, and no one knows exactly what those permissions enable.
🔗
Privilege Escalation Paths
▼
Cloud IAM has unique escalation patterns that are invisible without entitlement analysis. For example: a user with iam:PassRole + lambda:CreateFunction can effectively assume any role in the account by creating a Lambda function. These indirect privilege escalation paths are one of the most dangerous — and least understood — cloud security risks. PCCE maps these paths automatically.
🌐
Cross-Account & Cross-Cloud Trust
▼
Enterprise cloud environments often span dozens of AWS accounts, multiple Azure subscriptions, and GCP projects — connected by trust relationships that allow roles in one account to assume roles in another. Without a unified entitlement view, these trust chains create invisible lateral movement paths that span organizational boundaries. A compromise in a dev account could be the path to production.
🤖
Non-Human Identity (NHI) Entitlement Risk
▼
CI/CD pipelines, Lambda functions, Kubernetes workloads, and automation scripts all need cloud permissions — and they often get granted very broad access for convenience. Unlike human identities, NHIs can't be asked "do you still need this?" They operate silently, and their credentials — API keys, service account keys, instance profiles — are frequently the target of supply chain attacks and code repository scanning by adversaries.
What is CIEM?
🔬
Cloud Infrastructure Entitlement Management
Gartner-defined category, now integrated into PAM platforms

CIEM is the discipline of discovering, analyzing, and right-sizing cloud entitlements across all identities and cloud platforms. It combines continuous discovery of permissions, analytics to identify excess and risk, and automated remediation to enforce least privilege. Delinea PCCE integrates CIEM capabilities directly into the broader PAM and identity security platform.

Traditional PAMCIEM AlonePCCE (PAM + CIEM)
On-Prem Coverage ✓ – ✓
Cloud IAM Analysis – ✓ ✓
NHI Coverage Limited Partial ✓ Full
Entitlement Right-Sizing – ✓ ✓
Vault Integration ✓ – ✓
Unified Policy – – ✓
✅
Module Complete
You understand CIEM and the cloud entitlement challenge. Now let's explore exactly how Delinea PCCE solves it.
Module 04 Delinea Platform
Delinea PCCE
Privilege Control for Cloud Entitlements — Delinea's integrated solution for discovering, analyzing, governing, and right-sizing cloud permissions across every identity and cloud platform.
🔶
What is Delinea PCCE?
Delinea Privilege Control for Cloud Entitlements (PCCE) is a CIEM-integrated capability within the Delinea Platform that provides unified visibility and control over cloud entitlements across AWS, Azure, GCP, and multi-cloud environments. It continuously discovers all cloud identities and their effective permissions, identifies over-privileged and risky entitlements, and provides AI-driven right-sizing recommendations with direct remediation — all integrated with the broader Delinea PAM vault and governance workflows.
⚙️ PCCE Platform Architecture — Hover over components
Multi-Cloud Ingestion Sources
🟠 AWS IAM
🔵 Azure / Entra ID
🟢 GCP IAM
📦 SaaS Platforms
🏢 On-Prem AD
↓
PCCE Intelligence Engine
🔄 Continuous Discovery
🗺️ Effective Access Mapping
⚡ Risk & Escalation Analysis
🤖 AI Right-Sizing
↓
Integrated Governance & Remediation
🗂️ Unified Inventory
✂️ Policy Right-Sizing
🏦 Vault & JIT Integration
📋 Compliance Reporting
Key PCCE Capabilities
🔍
Continuous Multi-Cloud Entitlement Discovery
▼
PCCE continuously ingests IAM data from all connected cloud accounts and SaaS platforms — not as a periodic scan, but as a live feed of changes. Every new user, role, policy attachment, or permission grant is captured and analyzed within minutes. This gives security teams a real-time, accurate picture of the entitlement landscape, including effective permissions (what an identity can actually do, not just what's directly assigned) across all AWS accounts, Azure subscriptions, and GCP projects.
🗺️
Effective Access Mapping & Privilege Path Analysis
▼
Raw IAM policies are complex and nested — PCCE computes the effective access for every identity: what they can actually do after accounting for permission boundaries, SCPs, deny policies, and inherited group permissions. More critically, PCCE maps privilege escalation paths: which identities can effectively reach admin-level permissions through sequences of allowed actions, even if they don't hold an explicit admin role. These invisible paths are a top cloud security risk.
✂️
AI-Driven Right-Sizing & Least Privilege Enforcement
▼
PCCE analyzes actual usage patterns — which permissions were exercised by each identity over the last 30, 60, or 90 days — and generates right-sized policy recommendations that retain only what was actually used. These recommendations can be reviewed and applied with a single click, generating a new, minimal IAM policy. Over time, this progressively drives the environment toward true least privilege without disrupting operations.
⏱️
Just-In-Time Cloud Access & Vault Integration
▼
For highly sensitive cloud operations, PCCE integrates with the Delinea vault to provide JIT cloud access: instead of permanent role assignments, a developer requests elevated access for a specific task, the request goes through an approval workflow, a temporary role assumption is granted for a defined window, and all activity is session-recorded. After the window expires, the elevated access is automatically revoked — eliminating standing cloud privilege entirely.
🤖
Non-Human Identity (NHI) Governance
▼
PCCE specifically targets the NHI explosion: Lambda functions, EC2 instance profiles, GitHub Actions service accounts, Kubernetes service accounts, and automation pipelines. It discovers all NHIs across your cloud estate, assesses their permissions and usage, identifies stale or over-privileged machine identities, flags long-lived API keys and service account keys, and provides governance workflows to rotate, right-size, or decommission them.
📋
Compliance & Audit Reporting
▼
PCCE generates pre-built compliance reports mapped to major frameworks: CIS Benchmarks (AWS, Azure, GCP), SOC 2, ISO 27001, PCI-DSS, HIPAA, and NIST CSF. Auditors receive evidence that least privilege is actively enforced, privileged access is governed and time-limited, and all entitlement changes are logged and attributable — eliminating weeks of manual audit preparation.
📊 Sample PCCE Risk Finding Distribution
Typical findings from an initial PCCE deployment on a mid-size enterprise cloud environment
PCCE API — Entitlement Risk Report Sample Output
# PCCE Cloud Entitlement Analysis — Sample Report Summary

cloud_accounts_scanned: 47 # AWS accounts + Azure subscriptions + GCP projects
total_identities_discovered: 8,291
human_identities: 412
non_human_identities: 7,879 # 19x more NHIs than humans

entitlement_findings:
critical_escalation_paths: 23 # identities that can reach admin via indirect perms
stale_access_keys: 841 # not used in 90+ days
wildcard_policy_grants: 156 # Action:* or Resource:* in effect
cross_account_risks: 34 # lateral movement paths via STS trust
over_privileged_nhi: 3,241 # NHIs with unused permissions > 30 days

right_sizing_opportunity:
permissions_removable: 94% # of all granted permissions are unused
policies_generated: 412 # ready-to-apply least-privilege policies
jit_workflows_triggered: 23 # critical identities moved to JIT model

compliance_status:
cis_aws_benchmark: "72% → 96%" # after applying recommendations
pci_dss_least_privilege: "PASS"
report_format: "SOC2, ISO27001, CIS, NIST"

🏆 PCCE Business Value

  • Reduce cloud attack surface by removing 90%+ of unused permissions
  • Detect and eliminate privilege escalation paths before attackers find them
  • Replace manual IAM audits with continuous, automated governance
  • Accelerate compliance for SOC 2, PCI-DSS, and ISO 27001
  • Enable developer agility without compromising security posture
📌
PCCE Key Use Cases
  • Cloud IAM audit and least-privilege enforcement pre-audit
  • Discovery and governance of all service accounts across multi-cloud
  • Automated right-sizing of developer IAM roles to actual usage
  • JIT access for cloud console and CLI operations
  • NHI lifecycle management for Lambda, CI/CD, and container workloads
  • Cross-account trust chain visualization and risk scoring
✅
Module Complete
You've covered Delinea PCCE in depth. One final step — test your knowledge with the module quiz.
Module 05 Assessment
Knowledge
Check
Six questions across PAM, cloud identity security, cloud entitlements, and Delinea PCCE. Select the best answer for each.
—
—
—
Question 01 / 06
What does Just-In-Time (JIT) access mean in the context of cloud PAM?
Access that is automatically granted to new cloud users as soon as their account is created
A technique to pre-cache credentials for faster authentication to cloud consoles
✓
Privilege is granted only for the duration of an approved task, then automatically revoked — eliminating standing cloud privilege
A scheduling system that rotates which cloud admins have access each day
Question 02 / 06
According to industry data, approximately what percentage of cloud IAM permissions are never actually used?
Around 30% — most permissions are used occasionally
Around 50% — a significant but expected overhead in large environments
✓
Around 95% — the vast majority of granted permissions are never exercised
Around 70% — common in large organizations but manageable with good hygiene
Question 03 / 06
What is a "privilege escalation path" in cloud IAM, as addressed by PCCE?
A formal process for requesting elevated access through a ticketing system
✓
A sequence of allowed IAM actions through which an identity can effectively gain admin-level privileges without holding an explicit admin role
When an employee receives a promotion and their cloud permissions are updated to match their new role
The process of moving from on-premises admin access to cloud admin access during a migration
Question 04 / 06
Why does PCCE's "effective access mapping" matter more than simply reading raw IAM policies?
Raw IAM policies are encrypted and cannot be read directly by security tools
✓
An identity's actual permissions are determined by a combination of direct policies, group memberships, permission boundaries, SCPs, and deny rules — raw policies alone don't reveal what an identity can truly do
Raw policies only apply to human identities; effective access mapping covers non-human identities
PCCE reads policies faster than native cloud consoles, making audits more efficient
Question 05 / 06
What does PCCE's AI-driven "right-sizing" capability do?
It resizes cloud compute instances to reduce infrastructure costs
It automatically assigns admin rights to identities that frequently request elevated access
✓
It analyzes actual permission usage over time and generates minimal IAM policies that retain only what was actually used, enabling one-click enforcement of least privilege
It balances IAM policy complexity across cloud accounts to improve authentication performance
Question 06 / 06
Which of the following best describes the relationship between PCCE and the broader Delinea PAM platform?
PCCE is a completely separate product that does not share data with the Delinea vault
PCCE replaces traditional PAM vaulting for cloud environments, making the vault unnecessary
PCCE only works for AWS and does not support other cloud providers
✓
PCCE is an integrated CIEM capability within the Delinea Platform — discovered cloud identities can be enrolled into the PAM vault, subjected to JIT access workflows, and managed under a unified governance policy alongside on-prem identities