SearchContactBook a demo

[ SWOT Cloud PAM ]

Zero standing privilege for AWS, Azure and GCP.

Book a demo

Just-in-time privileged access for AWS, Azure and GCP, brokered at the gateway and recorded on a chain the session’s own user cannot rewrite.

Scroll to explore

Request it. Approve it. Then it expires.

Engineers stop holding long-lived cloud keys. Every session is requested, approved and time-bound, then brokered into short-lived STS or OAuth credentials.

20 Oct 2026 · 14:02Just-in-time access
Identity
priya.n@corp
Cloud
AWS · prod-billing
Credential
STS AssumeRole
Window
1 hour
Status
Approved
[ Sample request ]
  1. [ 1.0 ]RequestRole, account, duration and a reason
  2. [ 2.0 ]ApproveMulti-stage, with step-up MFA on risk
  3. [ 3.0 ]BrokerShort-lived credentials, clamped to the session
  4. [ 4.0 ]RevokeGone at expiry; a revoked grant stops within 60 seconds

Ask for exactly what you need, for as long as you need it.

Pick a cloud, a role and a window. Deterministic risk scoring decides the route: a standard approval, a second approver, or step-up MFA before the grant is issued.

Cloud
Role

Start, stop and change resources

Window
Context

Approvers see this. Example: CHG-4821 rotate billing keys

Brokered at the gateway. Recorded on a chain.

  • [ 1.0 ]

    Zero standing privilege

    Time-bound grants behind multi-stage approval. STS AssumeRole and Azure or GCP OAuth, with no persistent keys.

  • [ 2.0 ]

    Inline policy enforcement

    Dangerous cloud API calls are denied before they leave the gateway. A revoked grant stops working within 60 seconds.

  • [ 3.0 ]

    Tamper-evident session log

    A SHA-256 hash chain over every recorded event. The server anchors each checkpoint with a key clients never hold.

  • [ 4.0 ]

    Four enforcement modes

    Extension, Proxy, Both or Isolated, chosen per tenant. Proxy and Isolated refuse any session that skips the gateway.

  • [ 5.0 ]

    Console, CLI, SDK and IaC

    The whole management plane of AWS, Azure and GCP, with CloudTrail and Activity Log ingestion as a backstop.

  • [ 6.0 ]

    Isolated secure console

    The console runs in a server-side browser. Users drive pixels and never receive cloud credentials.

The gateway reads every API call before the cloud does.

Console, CLI, SDK and IaC calls pass through the Access Gateway. Dangerous operations are denied before they leave it.

Enforcing: dangerous calls are denied at the gateway.

Gateway log

  1. Pick a command to send it through the gateway.

Sample calls, policy and Shadow mode from Rudratic’s demo.

Four ways to enforce, set per tenant.

Choose how sessions reach the cloud. Proxy and Isolated refuse any session that skips the gateway; Isolated keeps cloud credentials off the device entirely.

Covers
Console, CLI, SDK and IaC through the gateway
Records
Every API call, signed and inspected at the gateway

A recording the user cannot rewrite.

Screens and API calls on one scrubber. Every event joins a SHA-256 hash chain, and the server signs checkpoints with a key clients never hold, so an edited recording fails verification.

Console

Signed in through the gateway

14:02:08
  1. 14:02:08 Signed in through the gateway…
  2. 14:02:31 Opened IAM › Roles…
  3. Server checkpoint 1Verified
  4. 14:03:02 s3:ListBucket billing-reports…
  5. 14:03:40 ec2:DescribeInstances…
  6. 14:04:15 cloudtrail:DeleteTrail (blocked)…
  7. Server checkpoint 2Verified
  8. 14:04:52 Session closed…

Sample session. Hashes are real SHA-256, computed in your browser; the server signature is simplified here (the product uses HMAC).

Break-glass, under dual control.

Emergency access under dual control. Two people unseal it, and everything from request to revocation is logged for review.

break-glass-admin

Sealed

  1. Unseal requested
  2. First approval
  3. Second approval
  4. Account unsealed
  5. Flagged for post-incident review

[ Sample account and steps. ]

One control planefor AWS, Azure and GCP.

Self-hosted in your cloud, on-premises or hybrid. One place to request, approve, record and report on privileged cloud access.

[ 1.0 ]

AWS, Azure and GCP

  • AWSSTS AssumeRole, clamped to the session
  • AzureOAuth credentials, clamped to the session
  • GCPShort-lived OAuth, clamped to the session
[ 2.0 ]

Denied before it leaves

  • cloudtrail:DeleteTrailBlocked
  • iam:CreateAccessKeyBlocked
  • roleAssignments/writeBlocked
  • s3:GetObjectAllowed

Sample calls from the interactive demo.

[ 3.0 ]

Risk-based approvals

Deterministic scoring on escalation, exfiltration, IP, geography and timing feeds a second approval and step-up MFA before the action runs. Admins can end a live session in one click; high-risk sessions end on their own.

[ 4.0 ]

Session playback

Screens and API calls on one scrubber, the chain verified on load. Search across sessions, export any one to JSON or CSV, and secrets stay redacted.

[ 5.0 ]

Secrets vault and break-glass

Provider credentials encrypted at rest, never logged and stripped from proxied calls. Emergency access under dual control, logged end to end.

[ 6.0 ]

Plugs into what you run

Sign-on (SAML, OIDC)

  • Entra ID
  • Okta
  • Google

Event export

  • Splunk
  • Microsoft Sentinel
  • Elastic
  • Datadog
  • Sumo Logic

Runs where you do. Cloud, on-premises or hybrid, on Node 20+ and PostgreSQL 13+.

[ 7.0 ]

Evidence packs

  • SOC 2
  • ISO 27001
  • HIPAA
  • PCI DSS
  • GDPR

Framework-mapped reports from the audit record. Whether a control is met depends on your configuration, scope and independent assessment.

What teams ask before they start.

[ 9 questions ]

What does SWOT Cloud PAM govern?

Privileged access to the management plane of AWS, Azure and GCP: the console, the CLI, SDKs and infrastructure as code.

How are cloud credentials issued?

Every session is requested, approved and time-bound, then brokered into short-lived STS AssumeRole or Azure and GCP OAuth credentials, clamped to the session. Engineers stop holding long-lived cloud keys.

How fast does revocation work?

A revoked grant stops working within 60 seconds. Admins can end a live session in one click, and high-risk sessions end on their own.

What do we install?

A control plane and the Access Gateway. Depending on the enforcement mode, a browser extension records console sessions, or an isolation service runs the console server-side.

Where does it run?

It is self-hosted: in your cloud, on-premises or hybrid. It runs on Node 20+ and PostgreSQL 13+, with Redis optional.

Which identity providers and SIEMs does it work with?

SAML and OIDC sign-on with Entra ID, Okta and Google, with MFA, step-up re-verification and break-glass. Events export to Splunk, Microsoft Sentinel, Elastic, Datadog and Sumo Logic, with email alerts over SMTP.

Can the recordings be trusted?

Every event is in a SHA-256 hash chain, and the server anchors checkpoints with a key clients never hold. Secrets are redacted in recordings, even inside gzip or base64, and each session exports to JSON or CSV with its chain verification.

Will it make us compliant?

It produces report packs mapped to SOC 2, ISO 27001, HIPAA, PCI DSS and GDPR from the audit record. Whether a control is met depends on your configuration, scope and independent assessment.

How does it relate to SWOT PAM?

SWOT Cloud PAM covers the cloud management plane. SWOT PAM covers privileged sessions to servers and databases. Together they cover a hybrid estate.

Lock downyour cloud accounts.

See just-in-time access, inline blocking and session playback on your own AWS, Azure or GCP accounts.

Book a demo

SWOT Cloud PAM —just-in-time access for AWS, Azure and GCP