Executive Summary
Choose a cloud PAM platform on four things: how it grants and removes cloud roles just in time, how workloads get short-lived credentials, how it brokers and records sessions, and how it finds the privileges nobody is using.
A cloud privileged access management (PAM) platform controls administrative access to cloud accounts, servers, Kubernetes clusters and databases. The infrastructure security features to compare are just-in-time elevation of cloud roles, short-lived credentials for people and workloads, brokered and recorded sessions, and discovery of standing privilege. Shared-account vaulting for on-premises servers, endpoint privilege and the wider PAM program are covered in the privileged access management guide.
The eight vendors here fall into five approaches: vault, session and cloud-access suites; PAM from an identity governance vendor; privileged roles inside the identity provider; a secrets engine that issues dynamic credentials; and certificate-based infrastructure access. Ownership has changed in the past two years. Palo Alto Networks announced the completion of its acquisition of CyberArk on February 11, 2026. IBM announced on Feb. 27, 2025 that it had completed its acquisition of HashiCorp.
Run a privileged access assessment in your own cloud accounts before any vendor demo. The cloud providers’ own tools show which roles are held permanently and which permissions go unused, and Section 7 sets out the steps. The results become the test cases for the pilot.
Why Standing Cloud Privilege Is the Risk to Remove
Through their red and blue team assessments and their hunt and incident response activities, NSA and CISA identified improper separation of user and administrator privilege as one of the 10 most common network misconfigurations. The NSA and CISA advisory lists three common account separation misconfigurations observed by assessment teams: excessive account privileges, elevated service account permissions and non-essential use of elevated accounts.
NSA and CISA state that when a malicious actor compromises an application or service using a service account, the actor has the same privileges and access as the service account. In the cloud, the same applies to IAM roles attached to compute, CI/CD tokens and Kubernetes service accounts. Each one holds its permissions whether or not anything is using them.
NIST CSRC defines least privilege as the principle that a system should restrict the access privileges of users, or processes acting on behalf of users, to the minimum necessary to accomplish assigned tasks. Two terms describe how far a platform goes toward it. Palo Alto Networks describes JIT as a mechanism that enables existing privileges for a set window, and ZSP as an operating model where identities have no entitlements by default. A platform can offer the first without reaching the second, so ask each vendor which roles it leaves assigned when nobody is working.
The cloud providers set the same direction for their own platforms. AWS recommends that human users use temporary credentials when accessing AWS. AWS states that on AWS compute services such as Amazon EC2 or Lambda, AWS delivers the temporary credentials of an IAM role to the compute resource, so there is no need to distribute long lived credentials for an IAM user to those workloads. AWS states that workloads running outside AWS, such as on-premises servers, servers from other cloud providers or managed CI/CD platforms, can still use temporary credentials.
A PAM platform for cloud infrastructure should make temporary access the default for people and machines. Static access keys, long-lived service account keys and permanent owner roles are what it is there to remove.
What the Cloud Providers Include, and Where This Guide Ends
Each large cloud provider includes some just-in-time control for its own platform. Google Cloud states that Privileged Access Manager (PAM) controls just-in-time temporary privilege elevation for select principals, with audit logs showing who had access to what and when. Google Cloud states that a principal added as a requester to an entitlement can request a grant against it and, if successful, holds the roles listed in the entitlement until the end of the grant duration, after which Privileged Access Manager revokes them.
Microsoft describes Privileged Identity Management (PIM) as a service in Microsoft Entra ID that enables you to manage, control and monitor access to important resources in your organization. Microsoft states that organizations can give users just-in-time privileged access to Azure and Microsoft Entra resources and oversee what those users do with it. Microsoft lists key features of Privileged Identity Management including time-bound access with start and end dates, approval to activate privileged roles and multifactor authentication to activate any role.
Native controls cover one provider each. A third-party platform earns its cost when you run more than one cloud, when sessions to servers, Kubernetes and databases must be brokered and recorded in one place, or when one approval flow has to span clouds and SaaS. Start the comparison by listing what your cloud providers already do, then price only the gap.
This guide covers privileged access to cloud infrastructure. Shared-account vaulting for on-premises Windows and Unix servers, endpoint privilege management and the PAM program as a whole are in the privileged access management guide. Misconfigured cloud resources are a posture problem, covered in the cloud security posture management guide. Joiner, mover and leaver access reviews belong to identity governance and administration.
| Need | What it answers | Where it is covered |
|---|---|---|
| Privileged access to cloud infrastructure | Who can act as an administrator in cloud accounts, clusters and databases, for how long, and with what record | This guide |
| PAM across the whole estate | Vaulting, session control and endpoint privilege for on-premises and cloud systems | Privileged Access Management guide |
| Cloud configuration risk | Which cloud resources are exposed or misconfigured | Cloud Security Posture Management guide |
| Access reviews and lifecycle | Who should have which entitlement, and when it ends | Identity Governance & Administration guide |
| Certificates and keys | Issuing, renewing and revoking certificates across the estate | Certificate Lifecycle Management guide |
Which Infrastructure Security Features Should a Cloud PAM Platform Have?
Four features separate cloud PAM platforms: just-in-time elevation of cloud roles, short-lived credentials for workloads, brokered access to servers, Kubernetes and databases with session recording, and discovery of the privileges nobody uses. Most vendors cover all four on a feature list. Their documentation shows where each one starts from.
Just-in-time cloud roles. Palo Alto Networks states that Idira secures access to AWS, Azure, Google Cloud and Kubernetes through native CLI and consoles, using agentless session brokering and JIT entitlements in place of VPN and bastion dependencies. Delinea describes Privilege Control for Cloud Entitlements as a way to enforce least standing privilege across public clouds. BeyondTrust describes Entitle as an access management SaaS solution that automates just-in-time (JIT) access and permission management, which reduces standing privileges.
Short-lived credentials. HashiCorp states that the Vault AWS secrets engine generates AWS access credentials dynamically based on IAM policies, and that the credentials are automatically revoked when the Vault lease expires. Teleport describes itself as a certificate authority and identity-aware access proxy that implements protocols such as SSH, RDP, HTTPS, Kubernetes API and a variety of SQL and NoSQL database protocols. Teleport states that admins can configure a time to live (TTL) for certificates, and rotate CAs to invalidate previously issued certificates.
Brokered and recorded sessions. Okta states that Okta Privileged Access provides session recording and auditing for SSH and RDP connections. BeyondTrust describes Password Safe as a just-in-time (JIT) privileged access management solution that combines privileged password and session management to discover, manage and audit all privileged credential activity.
Discovery of standing privilege. Discovery tells you what to remove first. Microsoft states that before an organization starts using Privileged Identity Management, all role assignments are permanent, and that Discovery and insights (preview) lists privileged roles and how many users are in them. Ask each vendor to run discovery against a test account you have seeded with known permanent roles and unused keys, and count what it finds.
| Capability | What it does | What to test |
|---|---|---|
| Just-in-time cloud roles | Grants a cloud role for a set time, with approval, then removes it | Which clouds and SaaS apps it covers, and whether the role is removed or only the session ended |
| Short-lived credentials for workloads | Issues credentials or certificates that expire on their own | Time to live you can set, and how a pipeline or pod gets its first credential |
| Brokered access | Connects users to servers, clusters and databases without handing over a key | Protocols covered: SSH, RDP, Kubernetes API, the databases you run |
| Session recording | Records privileged sessions for audit and investigation | Search, retention and export to your SIEM |
| Standing-privilege discovery | Finds permanent roles, unused permissions and static keys | Results against a test account seeded with known findings |
| Approval and break-glass | Routes requests to approvers, with an emergency path | Approval in chat or ticketing tools, and how emergency access is logged |
Vendors in Cloud Privileged Access Management (PAM) Platforms
Representative vendors include BeyondTrust, CyberArk (Idira, Palo Alto Networks), Delinea, HashiCorp Vault / IBM, Microsoft Entra PIM / ID Governance, Okta Privileged Access, One Identity Safeguard and Teleport. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The approaches below follow what each product was built around before it covered cloud infrastructure. That origin still decides what comes without extra products.
Ownership has changed at two of the eight vendors. IBM announced on Feb. 27, 2025 that it had completed its acquisition of HashiCorp. IBM states that HashiCorp's Terraform and Vault offerings are available from IBM's automation software portfolio. Palo Alto Networks announced the completion of its acquisition of CyberArk on February 11, 2026. Palo Alto Networks states that CyberArk's Identity Security solutions will continue to be available as a standalone platform. A request for cyberark.com lands on paloaltonetworks.com. Palo Alto Networks describes Idira as an identity security platform built on CyberArk’s legacy and powered by Palo Alto Networks.
Two others bought cloud privileged access companies. Delinea announced on March 5, 2026 that it had completed its acquisition of StrongDM. A request for strongdm.com lands on delinea.com. Delinea states that StrongDM is now part of Delinea, delivering just-in-time access and runtime authorization. Okta announced on Sep. 4, 2025 that it had closed its acquisition of Axiom Security, which it describes as a Privileged Access Management (PAM) solution built for cloud, SaaS and database environments. Okta states that Axiom Security extends its ability to secure access to Kubernetes and databases.
Two of the suites sit with private equity firms. Francisco Partners lists BeyondTrust, which provides privileged identity and secure access security solutions, as a current private buyout investment. Clearlake states that Quest Software is backed by Clearlake Capital Group. Clearlake describes One Identity as a standalone and independent business unit within Quest that specializes in identity and access management (IAM), privileged access management (PAM) and identity governance administration (IGA).
The suites start from the vault and add cloud access. Delinea states that the deal unifies enterprise PAM with just-in-time runtime authorization to eliminate standing privilege in AI-driven environments. Delinea states that Secret Server provides a vault that identifies and secures every AI, machine, service, application, admin and root account. One Identity states that Safeguard On Demand combines a secure password safe, session management and a monitoring solution delivered from the cloud.
The identity providers extend sign-in into privileged access. Okta states that Okta Privileged Access is part of Okta Workforce Identity Cloud. Okta states that Okta Privileged Access grants temporary, time-bound access to certain resources just-in-time, and that the access expires automatically.
Cloud-native just-in-time vendors and identity governance vendors also sell into this market. Britive states that privileged access is created at the moment it's needed and removed when the task ends, automatically, across AWS, Azure, GCP and OCI. Saviynt announced on December 9, 2025 that funds managed by KKR led its Series B growth equity financing. Saviynt states that its AI-powered platform manages, secures and governs access for human, non-human and AI agent identities across an organization's applications, data and infrastructure. Saviynt states that it extended its platform with new products for AI Agent Identity Management, Non-Human Identity Management, Privileged Access Management and Identity Security Posture Management (ISPM).
| Vendor | Approach | Where it fits |
|---|---|---|
| Teleport | Certificate-based infrastructure access | Certificate authority and access proxy for SSH, RDP, Kubernetes and databases; priced on active users and protected resources |
| One Identity Safeguard | PAM from an identity governance vendor | Safeguard On Demand: password safe, session management and monitoring from the cloud |
| Microsoft Entra PIM / ID Governance | Privileged roles in the identity provider | Just-in-time activation of Microsoft Entra and Azure roles, with approval and MFA |
| Okta Privileged Access | Privileged roles in the identity provider | Just-in-time access and SSH and RDP session recording; licensed in Resource Units |
| HashiCorp Vault / IBM | Secrets engine with dynamic credentials | Dynamic AWS credentials revoked when the Vault lease expires; owned by IBM since February 2025 |
| BeyondTrust | Vault, session and cloud-access suite | Password Safe for privileged passwords and sessions; Entitle for just-in-time access as SaaS |
| CyberArk (Idira, Palo Alto Networks) | Vault, session and cloud-access suite | Now Idira; agentless access to AWS, Azure, Google Cloud and Kubernetes with JIT entitlements |
| Delinea | Vault, session and cloud-access suite | Secret Server vault; Privilege Control for Cloud Entitlements; StrongDM runtime authorization since March 2026 |
Eight vendors are named, across five approaches; cloud-native just-in-time vendors, open-source access proxies and the cloud providers’ own tools compete here too. Vendors were chosen only after the approaches were set, and no row is for sale. Vendors of cloud privileged access, listed here or not, can present their own products in the Spotlight below.
How Cloud PAM Is Priced
Cloud PAM is priced per user, per protected resource or in license units that cover both. Microsoft lists Microsoft Entra ID P2, which it describes as including privileged access for critical resources, at $10.00 per user per month, paid yearly. Okta states that Resource Units are how Privileged Access is licensed, and that the 1 Resource Unit included in the Essentials Suite can cover 2 Privileged Access users. Teleport states that customers pay only for what they use: active users and protected resources.
Most suites quote on request. Ask each vendor how it counts a workload identity, a service account, a Kubernetes cluster and a database, and whether machine identities are priced like people. Machine identities usually outnumber administrators, so that answer moves the total more than the price per user.
The assessment has a cost too. AWS states that IAM Access Analyzer offers external access findings for free, and charges for unused access findings based on the number of IAM roles and users analyzed per analyzer per month. Budget for the analysis period before the RFP, not only for the platform.
| Meter | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Per user | Each person who can request privileged access | Administrators and engineers | Contractors and on-call staff counted as full users |
| Per protected resource | Servers, clusters, databases or cloud accounts behind the platform | Infrastructure size | Autoscaling and short-lived hosts counted at their peak |
| License units | A pool covering users and resources at set ratios | Both | Ratios that change at renewal |
| Per workload or secret | Machine identities and the credentials issued to them | Pipelines and services | Machine identities growing faster than staff |
| Bundled in an identity suite | Privileged access included in a higher suite tier | All licensed users | Upgrading every user to reach a few administrators |
How Do You Run a Privileged Access Security Assessment Before Choosing a Vendor?
Run it in five steps, in your own accounts, with the cloud providers’ native tools, before any vendor demo. It produces three lists: permanent privileged roles, unused permissions and static credentials. Those lists become the pilot test cases and the baseline for the business case.
Export every assignment of owner, administrator and other privileged roles in each cloud, Kubernetes cluster and database, with the person or service that holds it. Microsoft states that before an organization starts using Privileged Identity Management, all role assignments are permanent, and that Discovery and insights (preview) lists privileged roles and how many users are in them.
AWS states that IAM provides last accessed information to help identify the users, roles, permissions, policies and credentials that are no longer needed, so they can be removed. AWS states that, when an unused access analyzer is created, IAM Access Analyzer continuously monitors all IAM roles and users in an AWS organization and accounts and generates findings for unused access. Google Cloud states that the IAM recommender generates policy insights by comparing a principal's total number of permissions with the permissions that the principal used in the last 90 days.
List every access key, service account key, CI/CD token and Kubernetes service account with privileged access, its owner and its rotation. Mark each static credential that temporary credentials could replace.
Record how people reach servers, clusters and databases today: bastion hosts, VPNs, shared keys, direct console access. Note which paths are recorded and which are not.
Pick ten permanent role assignments, five static workload credentials and three session paths. Give every finalist the same list, and measure how many each removes or replaces during the pilot.
What should you ask vendors about Cloud Privileged Access Management (PAM) Platforms?
Ask each finalist these questions, and ask for the answer to be shown in your own cloud account.