7.1.2 Configuring Credential Checkout for Cloud Services

The privileged accounts that are set up on the following cloud services can be managed through Privileged Account Manager. To manage those accounts, you must customize the sample script and add it to the Privileged Account Manager rule.

Following are the tested applications on which you can reset the password of the accounts that are existing for those applications:

IMPORTANT:Privileged Account Manager server must have Java 1.6 or higher for password reset to work on the following:

  • OpenStack

  • Amazon Web Services

  • Microsoft Azure

  • OpenStack

    OpenStack is a set of software tools designed for building and managing cloud computing platforms. You can enable the password check-out feature to access the OpenStack server.

    To enable the credential checkout feature for OpenStack, you can add the rules by using the OpenStack policy template or add an OpenStack resource and rule manually.

  • Amazon Web Services

    Amazon Web Services (AWS) is a bundled remote computing service that provides cloud computing infrastructure over the Internet with storage, bandwidth, and customized support for Application Programming Interfaces (API). You can enable the password check-out feature to access services in AWS cloud.

    To enable credential checkout feature for AWS, you can add the rules by using the AWS policy template or add a AWS resource and rule manually.

  • Microsoft Azure

    Microsoft Azure is a bundled remote computing service that provides cloud computing infrastructure over the Internet with storage, bandwidth, and customized support for Application Programming Interfaces (API). You can enable the password check-out feature to access services in Microsoft Azure.

    To enable credential checkout feature for Microsoft Azure, you can add the rules by using the Microsoft Azure policy template or add a Microsoft Azure resource and rule manually.

Enabling Credential Checkout for OpenStack

To enable credential checkout feature for the OpenStack server perform the following:

  1. In the OpenStack server, create a user and assign the user to a project (tenant) with a role. For information about user creation and project and role assignment, see OpenStack Documentation.

  2. In the Privileged Account Manager Administration Console,

    Add the OpenStack policy template to automatically add a resource and rule for OpenStack. This OpenStack resource and rule can be customized as required.

    Or

    Add a resource in the credential vault and a rule manually for OpenStack. For information about adding a resource, see contextual help. For information about adding a rule, see Adding a Rule.

    NOTE:For the password check out of accounts belonging to different OpenStack projects (tenants), you must create a different resource for each tenant.

Enabling Credential Checkout for Amazon Web Services

To enable credential checkout feature for Amazon Web Services (AWS) perform the following:

  1. In the Amazon Web Services cloud, create a user and assign permissions or policies to the user. For information about AWS user creation, see AWS Documentation.

  2. In the Privileged Account Manager Administration Console,

    Add the AWS policy template to automatically add a resource and rule for AWS. This resource and rule can be customized as required.

    Or

    Add a resource in the credential vault and a rule manually for AWS. For information about adding a resource, see contextual help. For information about adding a rule, see Adding a Rule.

Enabling Credential Checkout for Microsoft Azure

Prerequisite: Ensure that Privileged Account Manager password policies adhere to the Microsoft Azure password policies.

To enable credential checkout feature for Microsoft Azure:

  1. In the Microsoft Azure cloud, create a user and assign permissions or policies to the user. For information about Microsoft Azure user creation, see Microsoft Azure documentation.

  2. In the Privileged Account Manager Administration Console,

    Add the Microsoft Azure policy template to automatically add a resource and rule for Microsoft Azure. You can customize this resource and rule as required.

    or

    Add a resource in the Credential Vault and a rule manually for Microsoft Azure. Edit the resource in Privileged Account Manager and update the following fields:

    For information about adding a resource, see the contextual help. For information about adding a rule, see Adding a Rule.