Alright, let's cut through the marketing. I see a lot of talk about integrating privileged access management (PAM) with IT service management (ITSM) platforms, but the devil is always in the actual, day-to-day implementation. We're evaluating BeyondTrust for a major Kubernetes and on-prem migration, and ServiceNow is our central service catalog and ticketing system.
I need to know if anyone is running this combo **in production at scale**, not just a pilot for a handful of servers. I'm talking about the real, messy integration where you have hundreds of engineers, multiple cloud accounts, and a mix of legacy and containerized workloads.
Specifically, I'm looking for unfiltered feedback on these pain points:
* **The Approval Workflow:** Does the ServiceNow integration actually handle complex, multi-tier approvals (e.g., team lead *and* security) for time-bound access to production K8s clusters or cloud console roles? Or does it fall apart when you need conditional logic?
* **The Credential Injection:** BeyondTrust's "jump" to a target system is one thing. But for automated workflows (like a Terraform pipeline needing temporary elevated rights in AWS), how robust is the retrieval of temporary credentials via the BeyondTrust API, triggered from a ServiceNow change request? Is the latency acceptable?
* **The Configuration Hell:** What does the actual Terraform or Ansible code look like to keep the BeyondTrust policy definitions (like those for Azure AD PIM or AWS IAM roles) in sync with your infrastructure-as-code? I suspect a lot of manual JSON/YAML wrangling.
* **Observability & Auditing:** Can you truly get a unified audit trail from the ServiceNow ticket, through the BeyondTrust session, and into the target system's native logs (like a Linux `sudo` command or a K8s `kubectl exec`)? Or are you stitching together three different dashboards?
I'm prepared for this to be expensive and painful. My working assumption is that the out-of-the-box integration connectors are only a starting point and that we'll be writing a significant amount of glue code, dealing with API rate limits, and building custom monitoring. I just want to know *how much* glue code and *how brittle* the final construct is.
If you've been through this, tell me what you'd do differently. What broke in the first major incident? Where are the hidden costs (beyond the obvious licensing)? Be brutally honest.
Been there, migrated that
Yeah, the approval workflow part is exactly what I've been wondering about too. We're using a simpler PAM tool right now and scaling those conditional approvals is a headache. For something like a prod K8s cluster, you'd need the app owner and maybe a separate platform team sign-off, and then it has to expire cleanly.
How do you even model that in ServiceNow without a ton of custom scripting? I'm curious if BeyondTrust's plugin handles those parallel approvals or if it just becomes a bottleneck.
Learning by breaking
The plugin handles the basic handshake for a single approval queue, but you're right to question complex conditional logic. In our 18-month production deployment, we had to extend it with a custom ServiceNow workflow activity that polls BeyondTrust for the first approval's completion before escalating to the second tier (e.g., team lead *then* security). Out-of-the-box, it tried to do them in parallel, which violated our control framework. The real mess was auditing that custom flow for our SOX auditors.
On credential injection for pipelines, it's a mixed bag. The API for retrieving temporary credentials is stable, but you'll be managing those secret IDs and vaulting them again in your CI/CD tool. We ended up building a small sidecar service that abstracts that handshake, because having Terraform code directly call the BeyondTrust API introduced a dependency we couldn't version control cleanly. It works, but it adds another layer to debug at 2 a.m.