Granting Cloud-Side Permissions

The credentials entered in Administration > Cloud Integration must have, at minimum, the following permissions on the cloud provider side. Configure these before registering the account in Kron PAM.

AWS Secrets Manager access is controlled through IAM policies. The IAM User or Role whose credentials are entered in Cloud Integration must have the permissions required for the selected synchronization mode.

Pull Configuration

For Pull synchronization, PAM must be able to discover secrets, read secret metadata, and retrieve secret values.

·         secretsmanager:ListSecrets

o   Discover secrets in the configured region

·         secretsmanager:DescribeSecret

o   Read secret metadata

·         secretsmanager:GetSecretValue

o   Retrieve secret values

Step 1 - Create the Pull IAM Policy

1.      Log in to the AWS Management Console.

2.      Navigate to IAM > Policies.

3.      Click Create policy.

4.      Open the JSON policy editor.

5.      Paste the policy shown below.

6.      Click Next.

7.      Enter a policy name, for example KronPAM-CloudSecrets-Pull.

8.      Click Create policy.

Step 2 - Attach the Pull Policy

1.      Navigate to IAM > Users.

2.      Select the IAM User whose credentials are configured in PAM.

3.      Open the Permissions tab.

4.      Click Add permissions and select Attach policies directly.

5.      Search for KronPAM-CloudSecrets-Pull.

6.      Select the policy and complete the permission assignment.

Push Configuration

Push configuration includes all Pull permissions and additionally allows PAM to update existing secrets and create new secrets when required.

·         secretsmanager:PutSecretValue

·         secretsmanager:CreateSecret

·         secretsmanager:TagResource

Step 1 - Create or Update the Push IAM Policy

1.      Navigate to IAM > Policies.

2.      Create a new policy or edit the policy assigned to the PAM IAM User or Role.

3.      Open the JSON policy editor.

4.      Use the policy shown below.

5.      Save the policy.

6.      If a new policy was created, attach it to the IAM User or Role used by PAM.

Microsoft Azure Key Vault access is granted to the App Registration used by Cloud Integration through Azure Role-Based Access Control (RBAC).

Pull Configuration

For Pull-only synchronization, assign the Key Vault Secrets User role to the PAM App Registration. This role allows PAM to list and retrieve secrets without modifying them.

Step 1 - Open the Target Key Vault & Select the Pull Role

1.      Log in to the Azure Portal.

2.      Search for Key Vaults.

3.      Open the Key Vault that will be synchronized with PAM.

4.      In the left menu, select Access control (IAM).

5.      Click Add > Add role assignment.

6.      On the Role tab, search for Key Vault Secrets User.

7.      Select Key Vault Secrets User.

8.      Click Next.

Step 3 - Assign the Role to the App Registration

1.      On the Members tab, set Assign access to to User, group, or service principal.

2.      Click Select members.

3.      Search for the App Registration used by PAM.

4.      Select the App Registration.

5.      Click Select.

6.      Click Review + assign.

Step 4 - Assign Access to the Administrator Account

If a human administrator will browse the Key Vault and manually verify the integration, assign the appropriate Key Vault role to that account as well.

1.      Repeat the role assignment procedure.

2.      Select Key Vault Secrets User.

3.      Under Members, search for the administrator user account or e-mail address.

4.      Select the user.

5.      Click Review + assign.



Step 5 - Verify Pull Role Assignments

6.      Navigate to Key Vault > Access control (IAM) > Role assignments.

7.      Filter the list by Role = Key Vault Secrets User.

8.      Verify that the PAM App Registration is listed.

9.      If an administrator account was configured for manual testing, verify that it is listed as well.



Push Configuration

For Push functionality, PAM requires permission to create and update secrets. Assign the Key Vault Secrets Officer role to the PAM App Registration.

Step 1 - Assign the Push Role

1.      Navigate to Key Vault > Access control (IAM) > Add > Add role assignment.

2.      Search for Key Vault Secrets Officer.

3.      Select Key Vault Secrets Officer and click Next.

4.      Select User, group, or service principal.

5.      Select the PAM App Registration.

6.      Click Review + assign.

Step 2 - Verify Push Role Assignment

1.      Navigate to Key Vault > Access control (IAM) > Role assignments.

2.      Filter by Role = Key Vault Secrets Officer.

3.      Verify that the PAM App Registration is listed at the target Key Vault scope.

Google Cloud Secret Manager access is granted to the Service Account whose JSON credentials are configured in PAM.

Verify the Secret Manager API

1-       Open GCP Console.

2-       Select the project containing the secrets.

3-       Navigate to APIs & Services > Enabled APIs & services.

4-       Search for Secret Manager API and verify that it is enabled.

Pull Configuration

For Pull synchronization, the PAM Service Account requires both Secret Manager Viewer and Secret Manager Secret Accessor. Viewer provides discovery and metadata access; Secret Accessor provides secret payload access.

Step 1 - Open IAM

1-      Log in to the Google Cloud Console.

2-      Select the project containing the secrets.

3-      Navigate to IAM & Admin > IAM.

4-      Click Grant access.

Step 2 - Assign Pull Roles

5-      In New principals, enter the Service Account used by PAM (for example, kron-pam-cloud-integration@[project-id].iam.gserviceaccount.com).

6-      Under Assign roles, select Secret Manager Viewer.

7-      Click Add another role.

8-      Select Secret Manager Secret Accessor.

9-      Click Save.

Step 3 - Verify Pull Access

1-      Return to IAM & Admin > IAM.

2-      Search or filter for the PAM Service Account.

3-      Expand the principal entry if necessary.

4-      Verify that Secret Manager Viewer and Secret Manager Secret Accessor are both assigned.

Push Configuration

For Push functionality, assign the Secret Manager Admin role to the PAM Service Account. This role provides the Secret Manager permissions required to read payloads, create secrets, update secret metadata, and add new secret versions.

Step 1 - Update the Service Account Role

1.      Navigate to IAM & Admin > IAM.

2.      Locate the PAM Service Account.

3.      Click the Edit principal pencil icon.

4.      Add Secret Manager Admin.

5.      If the integration is being switched completely from Pull-only to Push mode, the separate Secret Manager Viewer and Secret Manager Secret Accessor roles are redundant because Secret Manager Admin already provides the required Secret Manager permissions.

6.      Click Save.



Step 2 - Verify Push Access

1.      Return to IAM & Admin > IAM.

2.      Search for the PAM Service Account.

3.      Verify that Secret Manager Admin is assigned to the Service Account in the intended project.