{"id":15221505,"url":"https://github.com/googlecloudplatform/terraform-google-pam","last_synced_at":"2025-10-20T00:32:26.394Z","repository":{"id":247853170,"uuid":"803906971","full_name":"GoogleCloudPlatform/terraform-google-pam","owner":"GoogleCloudPlatform","description":"Deploy Privileged Access Manager","archived":false,"fork":false,"pushed_at":"2025-01-09T22:34:34.000Z","size":236,"stargazers_count":1,"open_issues_count":3,"forks_count":4,"subscribers_count":12,"default_branch":"main","last_synced_at":"2025-01-30T11:33:59.663Z","etag":null,"topics":["cft-terraform","security-identity"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/GoogleCloudPlatform/pam/google","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GoogleCloudPlatform.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-21T15:31:08.000Z","updated_at":"2025-01-09T22:34:37.000Z","dependencies_parsed_at":"2024-07-11T01:10:29.878Z","dependency_job_id":"1c4a6a37-71dc-4dbb-8ff8-78fb19339b13","html_url":"https://github.com/GoogleCloudPlatform/terraform-google-pam","commit_stats":null,"previous_names":["googlecloudplatform/terraform-google-pam"],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fterraform-google-pam","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fterraform-google-pam/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fterraform-google-pam/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fterraform-google-pam/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GoogleCloudPlatform","download_url":"https://codeload.github.com/GoogleCloudPlatform/terraform-google-pam/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":237236958,"owners_count":19277082,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cft-terraform","security-identity"],"created_at":"2024-09-28T15:05:24.462Z","updated_at":"2025-10-20T00:32:26.389Z","avatar_url":"https://github.com/GoogleCloudPlatform.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cloud Privileged Access Manager (PAM) Module\nThis module makes it easy to set up [Privileged Access Manager](https://cloud.google.com/iam/docs/pam-overview). Privileged Access Manager (PAM) is a Google Cloud native, managed solution to secure, manage and audit privileged access while ensuring operational velocity and developer productivity. PAM enables just-in-time, time-bound, approval-based access elevations, and auditing of privileged access elevations and activity. PAM lets you define the rules of who can access, what they can access, and if they should be granted access with or without approvals based on the sensitivity of the access and emergency of the situation.\n\nFunctional examples are included in the [examples](https://github.com/GoogleCloudPlatform/terraform-google-pam/tree/main/examples) directory\n\n##  Usage\n\n```tf\n# Configure Cloud Privilege Access Management (PAM)\nmodule \"entitlement_project\" {\n  source  = \"GoogleCloudPlatform/pam/google\"\n  version = \"~\u003e 3.1\"\n\n  entitlement_id                  = \"example-entitlement-project\"\n  parent_id                       = var.project_id\n  parent_type                     = \"project\"\n  grant_service_agent_permissions = true\n\n  organization_id = var.org_id\n\n  entitlement_requesters = [\n    \"serviceAccount:${var.entitlement_requester}\",\n  ]\n  entitlement_approvers = [\n    \"domain:google.com\",\n  ]\n  role_bindings = [\n    {\n      role                 = \"roles/storage.admin\"\n      condition_expression = \"request.time \u003c timestamp(\\\"2024-04-23T18:30:00.000Z\\\")\"\n    },\n    {\n      role = \"roles/bigquery.admin\"\n    }\n  ]\n}\n```\n\n\u003c!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| auto\\_approve\\_entitlement | Whether or not to auto approve the entitlement. If true, entitlement will be auto approved without any manual approval | `bool` | `false` | no |\n| entitlement\\_approval\\_notification\\_recipients | List of email addresses to be notified when a request is granted | `list(string)` | `[]` | no |\n| entitlement\\_approvers | List of users, groups or domain who can approve this entitlement. Can be one or more of Google Account email, Google Group or Google Workspace domain. Required if auto\\_approve\\_entitlement is false (default) | `list(string)` | `[]` | no |\n| entitlement\\_availability\\_notification\\_recipients | List of email addresses to be notified when a entitlement is created. These email addresses will receive an email about availability of the entitlement | `list(string)` | `[]` | no |\n| entitlement\\_id | The ID to use for this Entitlement. This will become the last part of the resource name. This value should be 4-63 characters. This value should be unique among all other Entitlements under the specified parent | `string` | n/a | yes |\n| entitlement\\_pending\\_notification\\_recipients | List of additional email addresses to be notified when a grant is pending approval | `list(string)` | `[]` | no |\n| entitlement\\_requesters | Required List of users, groups, service accounts or domains who can request grants using this entitlement. Can be one or more of Google Account email, Google Group, Service account or Google Workspace domain | `list(string)` | n/a | yes |\n| grant\\_service\\_agent\\_permissions | Whether or not to grant roles/privilegedaccessmanager.serviceAgent role to PAM service account | `bool` | `false` | no |\n| location | The region of the Entitlement resource | `string` | `\"global\"` | no |\n| max\\_request\\_duration\\_hours | The maximum amount of time for which access would be granted for a request. A requester can choose to ask for access for less than this duration but never more | `number` | `1` | no |\n| organization\\_id | Organization id | `string` | n/a | yes |\n| parent\\_id | The ID of organization, folder, or project to create the entitlement in | `string` | n/a | yes |\n| parent\\_type | Parent type. Can be organization, folder, or project to create the entitlement in | `string` | n/a | yes |\n| requester\\_justification | If the requester is required to provide a justification | `bool` | `true` | no |\n| require\\_approver\\_justification | Do the approvers need to provide a justification for their actions | `bool` | `true` | no |\n| role\\_bindings | The maximum amount of time for which access would be granted for a request. A requester can choose to ask for access for less than this duration but never more | \u003cpre\u003elist(object({\u003cbr\u003e    role                 = string\u003cbr\u003e    condition_expression = optional(string)\u003cbr\u003e  }))\u003c/pre\u003e | n/a | yes |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| entitlement | Entitlement created |\n\n\u003c!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --\u003e\n\n## Requirements\n\nThese sections describe requirements for using this module.\n\n### Software\n\nThe following dependencies must be available:\n\n- [Terraform][terraform] v1.3+\n- [Terraform Provider for GCP][terraform-provider-gcp] plugin v6.5+\n\n### Service Account and User Permissions\n\nA service account with the following roles must be used to provision\nthe resources of this module:\n\n- PAM Service Agent : `roles/privilegedaccessmanager.serviceAgent`\n\n\nThe [Project Factory module][project-factory-module] and the\n[IAM module][iam-module] may be used in combination to provision a\nservice account with the necessary roles applied.\n\n### APIs\n\nA project with the following APIs enabled must be used to host the\nresources of this module:\n\n- Cloud API: `privilegedaccessmanager.googleapis.com`\n\nThe [Project Factory module][project-factory-module] can be used to\nprovision a project with the necessary APIs enabled.\n\n## Contributing\n\nRefer to the [contribution guidelines](./CONTRIBUTING.md) for\ninformation on contributing to this module.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgooglecloudplatform%2Fterraform-google-pam","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgooglecloudplatform%2Fterraform-google-pam","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgooglecloudplatform%2Fterraform-google-pam/lists"}