PAM_Config

[jezzanuena]

Hi Team. We are implementing CPAM, we have successfully configured the AWS PAM connection and got the import jobs working, however, we're lost in PAM_Config and Bootstrapping.

As of now, we are trying to get the CONSOLE part:

{
"Connection": "AWS_PAM",
"encryptionMechanism": "ENCRYPTED",
"maxRequestTime":"10000",
"whiteListedIPs" : "x.x.x.x",
"EVQuery":"ev.customproperty40='AWSPAM'",
"CONSOLE": {
"maxIDRequestableTime": "2592000",
"maxCredSessionRequestTime": "36000",
"maxCredlessSessionRequestTime": "36000",
"shareableAccounts": {
"IDQueryCredentials": "acc.name in ('account1')",
"IDQueryCredentialless": "acc.name in ('account1')"
},
"endpointAttributeMappings": [
{
"column": "accessquery",
"value": "where users.USERNAME is not null",
"feature": "endpointAccesssQuery"
},
{
"column": "allowChangePassword_sqlquery",
"value": "AC.ACCOUNTYPE != 'Platform Service Account'",
"feature": "allowChangepasswordquery"
},
{
"column": "customproperty43",
"value": "PAMDefaultUserAccountAccessControl",
"feature": "accountVisibilityControl"
}
]
}
}

The Bootstrap job result is a success but the PAM setting on the endpoint level did not enable as well as the accounts. Is there anything that we missed?

[Belwyn]

Hi @jezzanuena 

Thank you for reaching out to us, 

There are a few checks you can do if you're not viewing any results in the privileged access module post running the bootstrap Job.

1. Did the import of accounts and entitlements into the Saviynt environment run properly from target? 

2. Do you see the mentioned account in the PAM_Config imported into Saviynt? 

In your scenario it's this below highlighted account.

"shareableAccounts": {
"IDQueryCredentials": "acc.name in ('account1')",
"IDQueryCredentialless": "acc.name in ('account1')"
},  

3. If it is not seen in the account in the Saviynt import, then please check if the account is present in the target. 

Let us know if this helps,

Thanks & Regards, 

Belwyn.

[jezzanuena]

1. Did the import of accounts and entitlements into the Saviynt environment run properly from target?  YES

2. Do you see the mentioned account in the PAM_Config imported into Saviynt? YES

In your scenario it's this below highlighted account.

"shareableAccounts": {
"IDQueryCredentials": "acc.name in ('account1')",
"IDQueryCredentialless": "acc.name in ('account1')"
},  

[sk]

Can you please share the output of below query. Replace endpointkey with the key value of endpoint which didn't have PAM Enabled.

select * from endpoints_properties where endpointkey=<endpointkey>

[jezzanuena]

Hi @sk

Thank you for checking on this. Here is the result of the query. Please note that the PAM of the endpoint (AWS Console) has been enabled it is just that the accounts declared in the PAM_Config are not being enabled. Below is the properties of the endpoint of the AWS Console.

ENDPOINTS_PROPERTIES_KEY

APPTYPEKEY

ENDPOINTKEY

GOVERNANCE

MATURITY

PAMCONFIG

PAM_ERROR_DESCRIPTION

PAM_RESOURCE_TYPE

PAM_STATE

PLATFORM_VERSION

PLATFORM_TYPE

RISK

ENABLE_SNOW_SHOW

FEATURES

AOB_CONNECTION_IDENTIFIERS

7

4

7

{"maxSessionWarnPeriodInSec":"1802","maxReqExpWarnPeriodInSec":"902","maxSessionLimitInSec":"28802","maxConcurrentSession":"50","maxInActiveTimeInSec":"182","maxInActiveWarnPeriodInSec":"62","authenticationType":"KEY"}

No Error

Console

ENABLED

AWSConsole

[sk]

Hey couple of things.

1. In your last comment you mentioned Endpoint level PAM state is enabled but in your query output I see PAM_STATE is blank, If it is successfully enabled PAM_STATE should have value as ENABLED
2. What is the logic you used in below section which defines which accounts should get PAM ENABLED "shareableAccounts": {
   "IDQueryCredentials": "acc.name in ('account1')",
   "IDQueryCredentialless": "acc.name in ('account1')"
   },
3. Do you see accountconfig field getting populated for the accounts that you expected to be PAM Enabled, If so can you share the accountconfig details what you are seeing?

[NageshK]

@jezzanuena 
Was your issue resolved?

You cannot have the same account mentioned in both the Credentialless and Credentials categories. It can only be in one. Additionally, this account should be present in your AWS Account. Do you have an IAM user with the name "account1"?