PAM is the set of controls for accounts and credentials that can cause the most damage — domain admins, root, cloud owners, service accounts and API keys. It covers vaulting secrets, brokering and recording privileged sessions, enforcing approval and just-in-time elevation, and rotating credentials. The goal is to eliminate standing privilege and make every privileged action accountable.

JIT access grants elevated permissions only when needed, for a short window, and revokes them automatically. Instead of a permanent admin account an attacker can target year-round, privilege exists for minutes and is tied to an approved request. Lab 01 and the Vault labs issue short-lived, just-in-time credentials for both humans and workloads.

Vault is a secrets-management platform that stores, generates and rotates credentials behind identity-based policy. Its dynamic secrets engines mint short-lived database, cloud and SSH credentials on demand, so nothing long-lived sits in config files. The Vault labs build policies, auth methods like AppRole and Kubernetes auth, and dynamic secrets with a full audit trail.

Plain SSH keys are static: public keys pile up in authorized_keys files with no expiry and no central revocation, which becomes unmanageable at scale. SSH certificates are signed by a trusted certificate authority, carry an expiry and principals, and need no per-host key distribution — you revoke by letting them expire or rotating the CA. Labs 04 and the SSH mastery lab move you from keys to certificate-based access.

Service accounts, API keys and database credentials often outlive the people who created them and get copied into pipelines and images. Regular, automated rotation limits how long a leaked secret is useful and forces systems to fetch credentials dynamically rather than hard-code them. Vault's dynamic secrets and lease model make rotation the default rather than a manual chore.

A break-glass (emergency access) account is a highly controlled account used only when normal admin access fails — for example, if Conditional Access or the IdP locks everyone out. It is typically cloud-only, excluded from the very policies that could cause the lockout, protected with the strongest possible authentication, and closely monitored so any use raises an alert. Every hardening programme needs at least two.

A password vault stores and checks out static credentials; privileged identity management (PIM) grants time-boxed role activation with approval and justification, so no standing privilege exists to check out in the first place. They are complementary — vaults protect the secrets that must exist, while PIM removes the need for permanent elevated roles. Lab 18 covers the PIM activation and review model.