GCP has Privileged Access Manager in beta now

[rojomisin]

Just noticed this in beta today
https://cloud.google.com/iam/docs/pam-request-temporary-elevated-access

[rojomisin]

Just wondering if this is an onboarding of the awesome jit-access work into gcp platform as a product?
Also what would be migration path? I have a gcp project I will be testing PAM w/ soon but have not looked at it yet.

[elamcheliyan]

What is the difference between PAM and jit-access applications in terms of features? Does PAM has the same functionality as JIT access web application?

[jpassing]

I wrote up a post about JIT Access vs Privileged Access Manager, and what's next for JIT Access, I hope that provides some more context.

[elamcheliyan]

I had a quick review on Google Priviledged Access Manager. Unlike JIT Access, we can't use the Google groups for the role's approved list. The grant email notification has not been sent to the members added in the Google groups which are configured as approvers principle.
We are migrating to JIT Access to Google's Native Priviledged Access Manager service. We found this problem. Also in JIT Access(JIT Group) we could select the approver from the list but here it is not the case.

Could you guys please post if the behaviour of Google Priviledged Access Manager is correct?

[jpassing]

Unlike JIT Access, we can't use the Google groups for the role's approved list. The grant email notification has not been sent to the members added in the Google groups which are configured as approvers principle.

JIT Access and PAM differ in how they handle groups:

• JIT Access expands groups, and then lists the individual members as possible approvers. Depending on which approvers you select, JIT Access then sends emails to these approvers, not to the group.
• PAM doesn't expand groups and instead treats groups as a principal: When you specify a group as approver, PAM sends an email to that group -- not to individual members. All members of that group can then follow the link in the email and complete the approval.

If groups aren't working for you in PAM, then I suspect its because the groups aren't mail-enabled -- so the email that PAM sends to the group doesn't go anywhere. Is that possible?

[elamcheliyan]

Thanks for your email, Are there any options to enable email for the Groups in the group settings?

[jpassing]

If you're using Workspace, then groups are "mail-enabled" by default and group members should receive email notifications sent to the group.

If you're using M365 or some other external provider for email, then Google Cloud won't do the email distribution for you -- instead, it'll just send an email to the group's email address and it's up to the external email provider to distribute it to the right users.