DOCSEARCHbyAlgolia
Submit Docs

StrongDM Documentation

website·Indexed 40 days ago

https://www.strongdm.com/docs/

Documentation for StrongDM, a Zero Trust Privileged Access Management (PAM) platform. Includes guides on initial configuration, deployment scenarios using Terraform, Ansible, Chef, and CloudFormation, and networking setups for proxy clusters. Covers integrations with AWS, GCP, Microsoft Azure, Okta, PagerDuty, and Incident.io, as well as administration of parent/child organizations and environment variable configurations.

Tokens
145.3K
Snippets
347
Records
919
Agent score
75%

What's inside StrongDM

  1. Overview of Azure Cloud integration in StrongDM

    StrongDM allows administrators to manage command line access to Azure cloud resources. Users are authenticated with Azure and granted access levels configured on the Azure side. This integration supports:

    • Least Privilege: By creating multiple StrongDM resources, each with different credentials and permissions.
    • Just-in-Time (JIT) Access: Using StrongDM access workflows to request temporary access.
    • Context-Based Policy: Restricting access based on geographic location, device trust scores, or requiring MFA.

    Note: This configuration is specifically for managing the Azure cloud via the Azure CLI (az). Individual Azure-hosted resources must be set up separately in the Admin UI.

  2. Overview of Amazon Athena integration in StrongDM

    StrongDM allows you to add Amazon Athena as a datasource using AWS access keys for authentication. StrongDM proxies client connections through a node (gateway, relay, or proxy cluster) to provide centralized access control, credential management, and audit logging.

    Key requirements include:

    • An S3 bucket path for query results (required by Athena).
    • Support for standard Athena clients (JDBC/ODBC, AWS SDK/CLI, BI tools).
    • For JDBC clients, StrongDM supports versions 2.0.5, 2.0.6, and 3.0.0 to 3.6.0. Note that JDBC v3 requires a StrongDM certificate.

  3. Overview of PagerDuty integration for on-call access

    The PagerDuty integration allows StrongDM to sync selected on-call schedules. Every 15 minutes (or via manual trigger), StrongDM identifies which PagerDuty users are currently on call and adds matching StrongDM users to a corresponding StrongDM group. This enables administrators to grant standing access via roles or just-in-time access via access workflows to only those users currently on call.

  4. Overview of Amazon Elasticsearch/OpenSearch integration

    StrongDM supports Amazon Elasticsearch and Amazon OpenSearch clusters using AWS access keys (Access Key ID and Secret Access Key). Supported combinations include Elasticsearch domains with Elasticsearch clusters, OpenSearch domains with Elasticsearch clusters, and OpenSearch domains with OpenSearch clusters. StrongDM proxies these connections through a node (gateway, relay, or proxy cluster) to provide centralized access control, credential management, and audit logging. Clients connect using standard Elasticsearch and OpenSearch protocols over HTTPS (e.g., RESTful APIs via curl or SDKs).

  5. Overview of Azure MySQL Managed Identity integration

    StrongDM supports Azure Database for MySQL Flexible Servers and Single Servers configured for Azure AD identity authentication. Instead of storing long-lived MySQL passwords, StrongDM retrieves temporary access tokens from Azure Active Directory using a system-assigned or user-assigned managed identity. Connections are proxied through a StrongDM node (gateway, relay, or proxy cluster) deployed in the Azure environment where the managed identity is available.

  6. Overview of Microsoft Entra ID integration in StrongDM

    StrongDM allows organizations to manage privileges in Microsoft Entra ID by mapping StrongDM privilege levels to Entra ID groups. Instead of facilitating a direct connection to a service, StrongDM adds or removes users from specific Entra ID groups. This enables Just-in-Time (JIT) access, where users gain elevated permissions for a limited period. These privilege levels can be assigned directly by admins or requested via Access Workflows.

    Limitations:

    • No end-user connections are facilitated directly through the Entra ID resource.
    • Entra ID privilege levels cannot currently be used in policies.
    • Entra ID resources cannot be added to access rules within roles or dynamic access rules in workflows.

  7. Overview of StrongDM Explicit Routing

    Explicit Routing allows StrongDM administrators to segment nodes (gateways and relays) and resources into explicitly declared 'peering groups'. This predetermines the traffic flow from the client to the target resource, resulting in faster connection processes compared to the default fluid routing. It is particularly beneficial for organizations with a high number of nodes and resources. This feature is optional and can be managed via the CLI, SDKs, and Terraform.

  8. Overview of DocumentDB (Single Host) support in StrongDM

    StrongDM allows you to add Amazon DocumentDB (single host) clusters as managed resources. This enables centralized access control, credential management, and audit logging by proxying client connections through a StrongDM node (gateway, relay, or proxy cluster). It is compatible with any MongoDB-compatible client or driver that supports the MongoDB wire protocol, such as mongosh, MongoDB Compass, DBeaver, and standard application drivers (Node.js, Python, Java, Go, .NET).

  9. Overview of StrongDM Proxy Clusters

    Proxy clusters are the recommended deployment method for proxying client traffic to resources in StrongDM. They allow for network segmentation, where specific proxies are used to access specific resources. Proxy clusters typically sit behind load balancers to enable scaling and high availability.

    Key Constraints:

    • Every proxy worker within a single cluster must have access to the same set of resources.
    • Workers in separate environments with different resource access must belong to separate clusters.

  10. Overview of GCP Workforce Identity Federation (WIF) in StrongDM

    StrongDM allows management of access to the GCP Cloud Console and gcloud CLI using Workforce Identity Federation (WIF). This setup enables secure, auditable access using external identities via SAML, eliminating the need for static service account keys.

    Key capabilities include:

    • Least Privilege: By creating multiple StrongDM resources tagged with specific values, you can map different levels of access in GCP based on the resource the user connects through.
    • Just-in-Time (JIT) Access: Integration with StrongDM access workflows allows for request-based or standing access.
    • Context-Based Policy: Access can be restricted based on geographic location, device trust scores, or MFA challenges.

    Limitations:

    • StrongDM does not prevent privilege escalation within GCP; IAM roles must be configured correctly in the GCP Console.
    • For Web Console resources, StrongDM logs only cover the authentication event. All subsequent actions within the GCP console must be audited using GCP's native logs.

  11. Overview of Aurora MySQL datasource in StrongDM

    StrongDM allows adding Aurora MySQL databases as datasources using standard database credentials (username and password). Once added, StrongDM proxies client connections through a node (gateway, relay, or proxy cluster) to provide centralized access control, credential management, and audit logging. This is distinct from the IAM-based authentication method. Supported versions include Aurora MySQL 5.6, 5.7, and 8.0. It is compatible with standard MySQL CLI tools (mysql, mysqlsh), GUI clients (MySQL Workbench, DBeaver, DataGrip), and application frameworks using MySQL drivers.

  12. Overview of StrongDM Zero Trust PAM Platform

    StrongDM is a Zero Trust Privileged Access Management (PAM) platform designed for modern infrastructure. It integrates authentication, authorization, networking, and observability to provide secure, auditable, and time-bound access to databases, servers, Kubernetes clusters, cloud environments, and web applications.