Privileged Access Management in Google Cloud: Moving from Always-On Admin to Just-in-Time Access

 In most cloud environments, a handful of people hold powerful roles such as Project Owner, Compute Admin or Security Admin, and they hold them all the time. It feels convenient: when something breaks at 2 a.m., the engineer on call already has the access they need. But that convenience comes at a price. Every account with standing admin rights is a target. If its credentials are phished, leaked or misused, an attacker inherits those rights instantly, and nobody may notice until the damage is done.

Google Cloud's answer to this problem is Privileged Access Manager (PAM), a built-in service that lets organisations replace permanent privileges with temporary, approved and fully audited access.

What is Privileged Access Manager?

Privileged Access Manager is a native Google Cloud IAM capability that grants elevated permissions only when they are needed and only for as long as they are needed. Instead of permanently assigning a sensitive role to a user, administrators define what that user is eligible to request. When the user actually needs the access, they ask for it, provide a reason, optionally wait for approval, and receive the role for a fixed period. When the time is up, Google Cloud removes the access automatically.

This approach is often called just-in-time (JIT) access, and it is a core principle of zero-trust security: no one keeps more privilege than their current task requires.

How It Works

PAM is built around three simple concepts.

Entitlements. An entitlement is a rule created by an administrator. It specifies which IAM roles can be granted, on which resource (an organisation, folder or project), who is allowed to request them, the maximum duration of access, and whether approval is required.

Grants. When a user requests access under an entitlement, PAM creates a grant. The user states a justification, chooses how long they need the access (within the allowed maximum), and submits the request.

Approval and expiry. If the entitlement requires approval, designated approvers are notified and can approve or deny the request. Once approved, the role is applied. When the grant's duration ends, PAM revokes it on its own, so there is no manual clean-up and no forgotten admin accounts.

A typical flow looks like this: a developer needs to restart a production database, requests the "Cloud SQL Admin" entitlement for one hour with a short reason, their team lead approves it from an email notification, and an hour later the access disappears.

Key Benefits

Least privilege by default. Users carry only their everyday permissions. Elevated roles exist only for the duration of a specific task, which dramatically shrinks the window an attacker could exploit.

Clear accountability. Every request, justification, approval, denial and revocation is recorded in Cloud Audit Logs. Security and compliance teams can see exactly who had what access, when and why.

Flexible control. Administrators can require approval for highly sensitive roles while letting low-risk entitlements be self-approved, so security does not slow down routine work.

Native integration. Because PAM is part of Google Cloud IAM, there is no extra infrastructure to deploy or maintain. It works with existing roles, groups and resource hierarchies.

Easier compliance. Frameworks such as ISO 27001, SOC 2 and PCI DSS expect organisations to restrict and review privileged access. Time-bound, logged grants make those audits far simpler.

Getting Started

Setting up PAM takes only a few steps in the Google Cloud Console:

1. Enable the service. Open IAM & Admin → Privileged Access Manager and enable the PAM API for your organisation, folder or project.
2. Assign PAM roles. Give administrators the Privileged Access Manager Admin role, and make sure requesters and approvers have the appropriate permissions.
3. Create an entitlement. Choose the role to be granted, the resource it applies to, the eligible users or groups, the maximum duration, and the approvers if approval is required.
4. Test the flow. Sign in as an eligible user, request a grant, approve it as an approver, and confirm the access appears and then expires as expected.
5. Remove standing access. Once the entitlement works, remove the permanent role bindings it replaces. This final step is what actually delivers the security benefit.

Teams that prefer automation can manage entitlements through the gcloud pam command-line tool, the PAM API, or infrastructure-as-code tools such as Terraform.

Best Practices

Start with your most sensitive roles. Owner, Organisation Admin, Security Admin and IAM Admin are the best first candidates for just-in-time access.

Use groups, not individuals. Make Google Groups eligible for entitlements so access follows team membership as people join and leave.

Keep durations short. Grant access for the length of a typical task, often one to a few hours, rather than a full day.

Require approval where the risk is high. Separating the requester from the approver prevents a single compromised account from escalating its own privileges.

Plan for emergencies. Keep a well-protected, closely monitored break-glass account for situations where the normal approval flow is unavailable.

Review regularly. Audit entitlements and grant history every quarter, remove entitlements nobody uses, and watch for unusual request patterns.

Conclusion

Standing privileges are one of the easiest paths for attackers to move through a cloud environment. Google Cloud Privileged Access Manager closes that path by making elevated access temporary, justified, approved and fully logged, without adding friction to legitimate work. For any organisation running workloads on Google Cloud, moving critical admin roles behind PAM is one of the most effective security improvements you can make, and it can be done in an afternoon.