mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
17ed51f8aa
- Merge upstream/main with -X ours strategy to preserve Hanzo customizations - Strip all backend/src/ee/ files reintroduced by upstream (PAM, discovery, sub-org, permissions, etc.) - Create minimal group-dal stub for new upstream service dependency - Preserve MIT-licensed permission, audit-log, rate-limit, license stubs - Keep Hanzo branding, per-org encryption keys, Insights telemetry - Remove backend/package-lock.json (we use npm/pnpm)
60 lines
3.0 KiB
Plaintext
60 lines
3.0 KiB
Plaintext
---
|
|
title: "PAM Account"
|
|
sidebarTitle: "Accounts"
|
|
description: "Learn how to create and manage accounts in PAM to control access to resources like databases and servers."
|
|
---
|
|
|
|
An **Account** contains the credentials (such as a username and password) used to connect to a [Resource](/documentation/platform/pam/getting-started/resources).
|
|
|
|
## Relationship to Resources
|
|
|
|
Accounts belong to Resources. A single Resource can have multiple Accounts associated with it, each with different permission levels.
|
|
|
|
For example, your database would normally have multiple accounts. You might have a superuser account for admins, a standard read/write account for applications, and a read-only account for reporting.
|
|
|
|
In PAM, these are represented as:
|
|
- **Resource**: `production-database` (PostgreSQL)
|
|
- **Account 1**: `postgres` (Superuser)
|
|
- **Account 2**: `app-user` (Read/Write)
|
|
- **Account 3**: `analytics` (Read-only)
|
|
|
|
When a user accesses a PAM account, they access a specific **Account** on a **Resource**. Users navigate to a resource, then select an account within it to gain access.
|
|
|
|
## Creating an Account
|
|
|
|
<Info>
|
|
**Prerequisite**: You must have at least one [Resource](/documentation/platform/pam/getting-started/resources) created before adding accounts.
|
|
</Info>
|
|
|
|
To add an account, navigate to the **Resources** tab in your PAM project, click into the resource you want to add an account to, and then click **Add Account**.
|
|
|
|
|
|
|
|
Provide the credentials (username, password, etc.) for this account. The required fields vary depending on the resource type. For example, for a Linux server, you would enter the username and the corresponding password or SSH key.
|
|
|
|
|
|
|
|
Clicking **Create Account** will trigger a validation check. KMS will attempt to connect to the resource using the provided credentials to verify they are valid.
|
|
|
|
## Account Metadata
|
|
|
|
Accounts support custom key-value metadata that can be used to organize and classify access credentials.
|
|
|
|
- **At creation**: You can attach metadata key-value pairs when creating an account through the creation modal.
|
|
|
|
|
|
|
|
- **On the details page**: After creation, account metadata can be viewed and edited from the account details page.
|
|
|
|
|
|
|
|
- **Filtering**: You can filter the accounts list view by metadata key-value pairs.
|
|
|
|
|
|
|
|
## Automated Credential Rotation
|
|
|
|
KMS supports automated credential rotation for some accounts on select resources, allowing you to automatically change passwords at set intervals to enhance security.
|
|
|
|
To learn more about how to configure this, please refer to the [Credential Rotation guide](/documentation/platform/pam/product-reference/credential-rotation).
|