Leveraging Intelligent Recommendations for Operational Transformation. AMS Partners click HERE | EMEA/APJ Partners click HERE |
11/01/2022 10:01 PM
Hi Team. We are implementing CPAM, we have successfully configured the AWS PAM connection and got the import jobs working, however, we're lost in PAM_Config and Bootstrapping.
As of now, we are trying to get the CONSOLE part:
{
"Connection": "AWS_PAM",
"encryptionMechanism": "ENCRYPTED",
"maxRequestTime":"10000",
"whiteListedIPs" : "x.x.x.x",
"EVQuery":"ev.customproperty40='AWSPAM'",
"CONSOLE": {
"maxIDRequestableTime": "2592000",
"maxCredSessionRequestTime": "36000",
"maxCredlessSessionRequestTime": "36000",
"shareableAccounts": {
"IDQueryCredentials": "acc.name in ('account1')",
"IDQueryCredentialless": "acc.name in ('account1')"
},
"endpointAttributeMappings": [
{
"column": "accessquery",
"value": "where users.USERNAME is not null",
"feature": "endpointAccesssQuery"
},
{
"column": "allowChangePassword_sqlquery",
"value": "AC.ACCOUNTYPE != 'Platform Service Account'",
"feature": "allowChangepasswordquery"
},
{
"column": "customproperty43",
"value": "PAMDefaultUserAccountAccessControl",
"feature": "accountVisibilityControl"
}
]
}
}
The Bootstrap job result is a success but the PAM setting on the endpoint level did not enable as well as the accounts. Is there anything that we missed?
11/01/2022 11:18 PM
Hi @jezzanuena
Thank you for reaching out to us,
There are a few checks you can do if you're not viewing any results in the privileged access module post running the bootstrap Job.
1. Did the import of accounts and entitlements into the Saviynt environment run properly from target?
2. Do you see the mentioned account in the PAM_Config imported into Saviynt?
In your scenario it's this below highlighted account.
"shareableAccounts": {
"IDQueryCredentials": "acc.name in ('account1')",
"IDQueryCredentialless": "acc.name in ('account1')"
},
3. If it is not seen in the account in the Saviynt import, then please check if the account is present in the target.
Let us know if this helps,
11/01/2022 11:21 PM
1. Did the import of accounts and entitlements into the Saviynt environment run properly from target? YES
2. Do you see the mentioned account in the PAM_Config imported into Saviynt? YES
In your scenario it's this below highlighted account.
"shareableAccounts": {
"IDQueryCredentials": "acc.name in ('account1')",
"IDQueryCredentialless": "acc.name in ('account1')"
},
11/16/2022 09:38 AM
Can you please share the output of below query. Replace endpointkey with the key value of endpoint which didn't have PAM Enabled.
select * from endpoints_properties where endpointkey=<endpointkey>
11/20/2022 02:38 PM
Hi @Saathvik
Thank you for checking on this. Here is the result of the query. Please note that the PAM of the endpoint (AWS Console) has been enabled it is just that the accounts declared in the PAM_Config are not being enabled. Below is the properties of the endpoint of the AWS Console.
ENDPOINTS_PROPERTIES_KEY | APPTYPEKEY | ENDPOINTKEY | GOVERNANCE | MATURITY | PAMCONFIG | PAM_ERROR_DESCRIPTION | PAM_RESOURCE_TYPE | PAM_STATE | PLATFORM_VERSION | PLATFORM_TYPE | RISK | ENABLE_SNOW_SHOW | FEATURES | AOB_CONNECTION_IDENTIFIERS |
7 | 4 | 7 | {"maxSessionWarnPeriodInSec":"1802","maxReqExpWarnPeriodInSec":"902","maxSessionLimitInSec":"28802","maxConcurrentSession":"50","maxInActiveTimeInSec":"182","maxInActiveWarnPeriodInSec":"62","authenticationType":"KEY"} | No Error | Console | ENABLED | AWSConsole |
11/21/2022 06:32 AM
Hey couple of things.
02/10/2023 02:19 PM
@jezzanuena
Was your issue resolved?
You cannot have the same account mentioned in both the Credentialless and Credentials categories. It can only be in one. Additionally, this account should be present in your AWS Account. Do you have an IAM user with the name "account1"?