Discover GCP resources and principals, rotate cloud and Google Workspace credentials, grant approved time-bound access through Google identity and keep Google Cloud Secret Manager synchronized from Keeper Vault—all through KeeperPAM and a Gateway in your environment.
KeeperPAM brings discovery, identity-based just-in-time access, credential rotation and secrets synchronization into one governed lifecycle for Google Cloud infrastructure and identities.
Keeper Gateway uses the GCP PAM Configuration to identify Compute Engine VMs, Cloud SQL instances, Managed Microsoft AD and principals found in project IAM policies. Customizable rules determine which findings become managed KeeperPAM records.
Keeper Privileged Cloud grants approved group membership, roles or entitlements through Google identity for a defined access window. Users continue through the target platform's normal authentication flow, and Keeper removes the temporary assignment automatically when access expires.
Rotate accounts linked to Compute Engine, Cloud SQL and Managed Microsoft AD, along with Google Workspace principals discovered in project IAM policies. Workspace password rotation uses a service account with domain-wide delegation and an authorized Google administrator.
Represent Compute Engine as PAM Machine, Cloud SQL as PAM Database, Managed Microsoft AD as PAM Directory and Google Workspace principals as PAM User records.
Configure JIT and Workflow on a PAM Cloud resource to set the target group or role, approval path, access duration, justification and ticket requirements.
Use rules to add, ignore or review findings before they enter a Shared Folder, then run deeper discovery to identify local users and services on managed resources.
Universal Secrets Sync sends changed Keeper records to Google Cloud Secret Manager through Keeper Gateway, preserving metadata tags for the record UID, type and title.
Keeper Gateway authenticates with a dedicated service-account Sync Identity and writes directly to Google Cloud. Plaintext never crosses Keeper's cloud infrastructure, and each result is audited.
Grant GCP groups, roles or entitlements only for an approved window and remove them automatically when access expires.
Identify Compute Engine, Cloud SQL, managed directories, principals and local accounts through Keeper Gateway.
Apply rotation to GCP resource accounts and Google Workspace principals using scoped service-account access.
Update a secret once in Keeper Vault and push the change directly to Google Cloud Secret Manager through Keeper Gateway.
After approval, Keeper temporarily grants the mapped Google identity group membership, role or entitlement for the configured duration, then removes it automatically. Users continue through the cloud console, SSO, CLI or SDK workflow that evaluates that identity change.
Keeper supports accounts associated with Compute Engine, Cloud SQL and Managed Microsoft AD, plus Google Workspace principals. Workspace password rotation requires domain-wide delegation, the Admin Directory API scope and an authorized Google administrator.
Keeper Discovery identifies Compute Engine VMs, Cloud SQL instances, Managed Microsoft AD, IAM principals and related local users or services. Rules can add, ignore or prompt for each finding before onboarding.
Keeper Vault remains the source of truth. When a linked record changes, Keeper Gateway uses the configured service-account Sync Identity to write the updated value directly to Google Cloud Secret Manager. Multi-folder sync, dry-run previews, metadata tags and audit logging are supported.
Debe habilitar las cookies para usar el chat en directo.
