A multinational enterprise is designing a just-in-time (JIT) privileged access architecture in Google Cloud for their production storage environment. The security team has defined the following operational and compliance requirements: Both human on-call engineers (in an sre-team@example.com group) and an automated deployment pipeline identity (deploy-runner@proj.iam.gserviceaccount.com) must be able to temporarily elevate to roles/storage.admin. Human grant requests must mandate business justifications, while approval must be automated programmatically by a dedicated ITSM validation service account (itsm-validator@proj.iam.gserviceaccount.com) to eliminate manual bottlenecks. Temporary privilege elevation must be restricted to a maximum grant duration of 4 hours. Operational overhead and identity privilege must follow the principle of least privilege without assigning unnecessary administrative roles to requesters or approvers. Which Privileged Access Manager (PAM) entitlement configuration meets these requirements?

Create a PAM entitlement specifying the target resource, list the SRE group and deployment service account as eligible requesters, assign `roles/storage.admin` with a maximum duration of 4 hours, require justification, and configure the ITSM service account as an approver without granting requesters or approvers `roles/privilegedaccessmanager.admin`.: ### What Privileged Access Manager (PAM) Entitlements Are **Privileged Access Manager (PAM)** is a Google Cloud security service designed to manage, automate, and audit just-in-time (JIT) privilege elevation. PAM uses **entitlements** as policy definitions that establish which principals can request elevated roles, what roles can be obtained, the maximum grant lifespan, mandatory justifications, and approval workflows. ### How It Meets the Requirements - **Eligible Human and Non-Human Requesters**: PAM natively supports both human users (such as Google Groups like `sre-team@example.com`) and non-human identities (service accounts like `deploy-runner@proj.iam.gserviceaccount.com`). Service accounts can self-elevate for automated deployment tasks rather than holding permanent high-privilege bindings. - **Automated ITSM Approval**: PAM allows service accounts to be designated as **approvers** in an approval workflow. An ITSM system can validate change management tickets and invoke the PAM API (`gcloud pam grants approve` or REST endpoint) using the `itsm-validator` service account credentials, removing manual operator delays. - **Maximum Duration and Justifications**: The entitlement explicitly enforces a maximum grant duration of 4 hours (14,400 seconds) and requires mandatory structured or unstructured justifications before a grant request can transition to the `APPROVAL_AWAITED` or `ACTIVE` state. - **Least Privilege for PAM Management**: Principals requesting grants and approving/denying grants **do not require** any PAM-specific administrative IAM permissions (such as `roles/privilegedaccessmanager.admin`). They only interact with their assigned requester and approver bindings. ### Key Advantages - **Eliminates Standing Privileges**: Replaces persistent administrative role assignments with temporary, time-bound grants that automatically expire. - **Full Auditability**: Automatically records who requested access, the justification provided, the approver identity, and the exact active window in Cloud Audit Logs. - **Separation of Duties**: Decouples the entitlement creation policy from request and approval roles. ### Why This Is Optimal This architecture directly satisfies all least-privilege, multi-identity, automation, and governance requirements using native Google Cloud PAM functionality without custom infrastructure or unnecessary privilege delegation.

Configure Pam Entitlements Workflows Approvers | Professional Cloud Security Engineer

Configure Pam Entitlements Workflows Approvers

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational enterprise is designing a just-in-time (JIT) privileged access architecture in Google Cloud for their production storage environment. The security team has defined the following operational and compliance requirements:

Both human on-call engineers (in an sre-team@example.com group) and an automated deployment pipeline identity (deploy-runner@proj.iam.gserviceaccount.com) must be able to temporarily elevate to roles/storage.admin.
Human grant requests must mandate business justifications, while approval must be automated programmatically by a dedicated ITSM validation service account (itsm-validator@proj.iam.gserviceaccount.com) to eliminate manual bottlenecks.
Temporary privilege elevation must be restricted to a maximum grant duration of 4 hours.
Operational overhead and identity privilege must follow the principle of least privilege without assigning unnecessary administrative roles to requesters or approvers.

Which Privileged Access Manager (PAM) entitlement configuration meets these requirements?

Assign permanent roles/storage.admin IAM bindings with time-based IAM Conditions to the SRE group and deployment service account, and use a Cloud Function to update the condition timestamp upon ITSM ticket generation.

Create a PAM entitlement with roles/storage.admin and assign roles/privilegedaccessmanager.admin and roles/iam.securityAdmin to all SREs and the ITSM service account so they have API permissions to request and approve grants.

Create a PAM entitlement specifying the target resource, list the SRE group and deployment service account as eligible requesters, assign roles/storage.admin with a maximum duration of 4 hours, require justification, and configure the ITSM service account as an approver without granting requesters or approvers roles/privilegedaccessmanager.admin.

Create a Google Group with roles/storage.admin, configure the ITSM service account to add members via the Cloud Identity API upon request, and run a scheduled cron job to remove members after 4 hours.

Professional Cloud Security Engineer

Configure Pam Entitlements Workflows Approvers

Related questions