---
title: Granting Cloud-Side Permissions
slug: kronpam-reference-guide-3-9-0/granting-cloud-side-permissions
docTags: 
createdAt: 2026-10-09T10:42:23.989Z
---

The credentials entered in Administration > Cloud Integration must have, at minimum, the following permissions on the cloud provider side. Configure these before registering the account in Kron PAM.

### AWS

AWS Secrets Manager access is controlled through IAM policies. The IAM User or Role whose credentials are entered in Cloud Integration must have the permissions required for the selected synchronization mode.

**Pull Configuration**

For Pull synchronization, PAM must be able to discover secrets, read secret metadata, and retrieve secret values.

·         secretsmanager\:ListSecrets

o   Discover secrets in the configured region

·         secretsmanager\:DescribeSecret

o   Read secret metadata

·         secretsmanager\:GetSecretValue

o   Retrieve secret values

**Step 1 - Create the Pull IAM Policy**

1.      Log in to the AWS Management Console.

2.      Navigate to IAM > Policies.

3.      Click Create policy.

4.      Open the JSON policy editor.

5.      Paste the policy shown below.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListCloudSecrets",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:ListSecrets"
            ],
            "Resource": "*"
        },
        {
            "Sid": "ReadCloudSecrets",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:DescribeSecret",
                "secretsmanager:GetSecretValue"
            ],
            "Resource": "*"
        }
    ]
}

```

6.      Click Next.

7.      Enter a policy name, for example KronPAM-CloudSecrets-Pull.

8.      Click Create policy.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/NkftdbfmgpG70AwqCiiuH_image.png "Figure – AWS Secrets Manager Pull IAM Policy")

**Step 2 - Attach the Pull Policy**

1.      Navigate to IAM > Users.

2.      Select the IAM User whose credentials are configured in PAM.

3.      Open the Permissions tab.

4.      Click Add permissions and select Attach policies directly.

5.      Search for KronPAM-CloudSecrets-Pull.

6.      Select the policy and complete the permission assignment.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/TbAaKsm8x-nrA8S7GCXL-_image.png "Figure – AWS IAM Pull Policy Assignment")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/4n06M3uB9zcLiygNbS7Di_image.png "Figure – AWS Secrets Manager Console (target secrets to be pulled)")

:::hint{type="warning"}
secretsmanager\:ListSecrets requires Resource "\*" because the operation does not support resource-level permissions. If Secrets Manager secrets use a customer-managed KMS key, additional KMS permissions such as kms\:Decrypt may also be required.
:::

**Push Configuration**

Push configuration includes all Pull permissions and additionally allows PAM to update existing secrets and create new secrets when required.

·         secretsmanager\:PutSecretValue

·         secretsmanager\:CreateSecret

·         secretsmanager\:TagResource

**Step 1 - Create or Update the Push IAM Policy**

1.      Navigate to IAM > Policies.

2.      Create a new policy or edit the policy assigned to the PAM IAM User or Role.

3.      Open the JSON policy editor.

4.      Use the policy shown below.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListCloudSecrets",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:ListSecrets"
            ],
            "Resource": "*"
        },
        {
            "Sid": "ReadWriteCloudSecrets",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:DescribeSecret",
                "secretsmanager:GetSecretValue",
                "secretsmanager:PutSecretValue",
                "secretsmanager:CreateSecret",
                "secretsmanager:TagResource"
            ],
            "Resource": "*"
        }
    ]
}

```

5.      Save the policy.

6.      If a new policy was created, attach it to the IAM User or Role used by PAM.

### Microsoft Azure

Microsoft Azure Key Vault access is granted to the App Registration used by Cloud Integration through Azure Role-Based Access Control (RBAC).

:::hint{type="warning"}
An App Registration must already exist in Microsoft Entra ID. Its Client ID, Tenant ID, and Client Secret are entered in the PAM Cloud Integration configuration.
:::

**Pull Configuration**

For Pull-only synchronization, assign the Key Vault Secrets User role to the PAM App Registration. This role allows PAM to list and retrieve secrets without modifying them.

**Step 1 - Open the Target Key Vault & Select the Pull Role**

1.      Log in to the Azure Portal.

2.      Search for Key Vaults.

3.      Open the Key Vault that will be synchronized with PAM.

4.      In the left menu, select Access control (IAM).

5.      Click Add > Add role assignment.

6.      On the Role tab, search for Key Vault Secrets User.

7.      Select Key Vault Secrets User.

8.      Click Next.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/T1Z9UyGDVHfRBC1nyr6SX_image.png "Figure – Azure Key Vault Overview")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/b4TfMHlQHTs1TLeXwNpyU_image.png "Figure – Azure Key Vault Secrets User Role Selection")

**Step 3 - Assign the Role to the App Registration**

1.      On the Members tab, set Assign access to to User, group, or service principal.

2.      Click Select members.

3.      Search for the App Registration used by PAM.

4.      Select the App Registration.

5.      Click Select.

6.      Click Review + assign.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Vj5eV9d_zleMSEniNVFLr_image.png "Figure – Azure Key Vault Pull Role Assignment")

**Step 4 - Assign Access to the Administrator Account**

If a human administrator will browse the Key Vault and manually verify the integration, assign the appropriate Key Vault role to that account as well.

1.      Repeat the role assignment procedure.

2.      Select Key Vault Secrets User.

3.      Under Members, search for the administrator user account or e-mail address.

4.      Select the user.

5.      Click Review + assign.



**Step 5 - Verify Pull Role Assignments**

6.      Navigate to Key Vault > Access control (IAM) > Role assignments.

7.      Filter the list by Role = Key Vault Secrets User.

8.      Verify that the PAM App Registration is listed.

9.      If an administrator account was configured for manual testing, verify that it is listed as well.



**Push Configuration**

For Push functionality, PAM requires permission to create and update secrets. Assign the Key Vault Secrets Officer role to the PAM App Registration.

**Step 1 - Assign the Push Role**

1.      Navigate to Key Vault > Access control (IAM) > Add > Add role assignment.

2.      Search for Key Vault Secrets Officer.

3.      Select Key Vault Secrets Officer and click Next.

4.      Select User, group, or service principal.

5.      Select the PAM App Registration.

6.      Click Review + assign.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/roGtFjVnLPp6OfVlNey7X_image.png "Figure – Azure Key Vault Secrets Officer Role Selection")

**Step 2 - Verify Push Role Assignment**

1.      Navigate to Key Vault > Access control (IAM) > Role assignments.

2.      Filter by Role = Key Vault Secrets Officer.

3.      Verify that the PAM App Registration is listed at the target Key Vault scope.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/weMJCkty0VCKGBaqBWFPv_image.png "Figure – Azure Key Vault Secrets Officer Role Selection")

### Google Cloud Platform

Google Cloud Secret Manager access is granted to the Service Account whose JSON credentials are configured in PAM.

:::hint{type="warning"}
A GCP Service Account must already exist, a JSON key must be generated for that Service Account, and the Secret Manager API must be enabled in the project.
:::

**Verify the Secret Manager API**

1-       Open GCP Console.

2-       Select the project containing the secrets.

3-       Navigate to APIs & Services > Enabled APIs & services.

4-       Search for Secret Manager API and verify that it is enabled.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/LDTn79h34WviSNbrg0TS__image.png "Figure – GCP Secret Manager API Configuration")

**Pull Configuration**

For Pull synchronization, the PAM Service Account requires both Secret Manager Viewer and Secret Manager Secret Accessor. Viewer provides discovery and metadata access; Secret Accessor provides secret payload access.

**Step 1 - Open IAM**

1-      Log in to the Google Cloud Console.

2-      Select the project containing the secrets.

3-      Navigate to IAM & Admin > IAM.

4-      Click Grant access.

**Step 2 - Assign Pull Roles**

5-      In New principals, enter the Service Account used by PAM (for example, kron-pam-cloud-integration@\[project-id].iam.gserviceaccount.com).

6-      Under Assign roles, select Secret Manager Viewer.

7-      Click Add another role.

8-      Select Secret Manager Secret Accessor.

9-      Click Save.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/cyeiv_VZaaQK1r8k6nSPv_image.png "Figure – GCP Secret Manager Pull Role Assignment")

**Step 3 - Verify Pull Access**

1-      Return to IAM & Admin > IAM.

2-      Search or filter for the PAM Service Account.

3-      Expand the principal entry if necessary.

4-      Verify that Secret Manager Viewer and Secret Manager Secret Accessor are both assigned.

**Push Configuration**

For Push functionality, assign the Secret Manager Admin role to the PAM Service Account. This role provides the Secret Manager permissions required to read payloads, create secrets, update secret metadata, and add new secret versions.

**Step 1 - Update the Service Account Role**

1.      Navigate to IAM & Admin > IAM.

2.      Locate the PAM Service Account.

3.      Click the Edit principal pencil icon.

4.      Add Secret Manager Admin.

5.      If the integration is being switched completely from Pull-only to Push mode, the separate Secret Manager Viewer and Secret Manager Secret Accessor roles are redundant because Secret Manager Admin already provides the required Secret Manager permissions.

6.      Click Save.



**Step 2 - Verify Push Access**

1.      Return to IAM & Admin > IAM.

2.      Search for the PAM Service Account.

3.      Verify that Secret Manager Admin is assigned to the Service Account in the intended project.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/wujBGKBSPa5Hqbmuwmuzw_image.png "Figure – GCP Secret Manager Push Role Verification")

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/CAlJFcKMH6If2CpVpvpnb_image.png "Figure – Google Cloud Secret Manager Console")