What is PAM?

A digital identity used by software or a workload to authenticate without a person signing in for each request. Examples include service accounts and workload identities; API keys and tokens are credentials these identities may use. Check who owns the identity, which resources it can access, and how its credentials expire or are revoked.

The discipline of managing digital identities (human and non-human) and controlling what each identity can do. In cloud context (AWS IAM, GCP IAM), it refers specifically to the policy and role systems that govern resource access.

Least privilege means granting an identity only the actions and resources its task requires, then reviewing that access as the task changes. For example, a batch job that reads one bucket should not receive broad administrator permissions.

An architectural pattern that treats every request as untrusted by default, regardless of network location, and verifies identity and authorization on every call. For NHIs, this means continuous verification instead of "once issued, always trusted."

A service account is an account used by an application, script or workload to authenticate to another service. Its permissions, owner, credential lifetime and usage logs need review just like those of a human account.

Workload identity federation lets a workload in one environment, such as GitHub Actions, exchange a trusted identity assertion for access in another, such as AWS or Google Cloud. When configured for the workload, it can replace a stored long-lived cloud key; the trust policy and resulting permissions still need review.