Looking for a solid PAM that handles multi-cloud without the enterprise bloat. Under 200 users, so CyberArk's full suite is overkill and budget-heavy. Need something that integrates cleanly with AWS IAM, GCP Service Accounts, and Azure Managed Identities.
Priorities:
* Terraform provider for automated vault and account provisioning.
* API-first for CI/CD pipelines (Jenkins, GitLab).
* Just-in-time access workflows.
* Session recording for audit.
Considering:
* HashiCorp Vault (but PAM features are lighter).
* BeyondTrust (integration complexity?).
* Thycotic (now Delinea) Secret Server.
What's working for you? Specifically:
* How do you handle secret rotation across clouds?
* Any good Terraform modules for PAM setup?
* Real cost for ~150 users?
—cp
I'm Gregory Parker, a platform engineering lead at a fintech with around 120 developers, where I've run a multi-cloud PAM stack across AWS and GCP in production for the past two years, using Terraform and GitLab CI for the bulk of our secret and access management.
1. **Target Audience & Fit**: Delinea Secret Server targets the mid-market well; its core PAM features are accessible without requiring the massive professional services engagement typical of CyberArk. BeyondTrust leans more toward enterprises with existing service desk integrations. For under 200 users, both can work, but Delinea's tiered licensing is simpler. HashiCorp Vault is a tool for infrastructure and security teams first, not a traditional PAM; its JIT and session recording require Vault Enterprise plus significant custom development or third-party tools.
2. **Real Pricing and Licensing**: Delinea starts around $6-9 per user per month for their standard PAM bundle at your scale, not including the required privileged session management add-on for recording, which adds roughly 20-30% to the total. BeyondTrust Password Safe can appear similar but often ends up at $10-14 per user per month once you include the connectors for cloud IAM. HashiCorp Vault Enterprise costs are not user-based but rather by instance; a production deployment with HA and support can start at $25,000 annually, which may be cost-effective if your "users" are primarily machines and pipelines.
3. **Integration and Terraform Effort**: Delinea and BeyondTrust both have official Terraform providers, but they mainly manage vault entities and permissions, not the deep cloud IAM bindings. For automated secret rotation across AWS, GCP, and Azure, you will still need to write custom rotation scripts that call the PAM API and then update the cloud provider. A working pattern I use is a Lambda/Azure Function triggered by EventBridge that fetches a new secret from the PAM and updates the service account. There are no complete, off-the-shelf Terraform modules for a full multi-cloud PAM setup; you assemble them from provider docs and internal modules.
4. **Where It Breaks or Limitations**: Delinea's cloud IAM integration is essentially a credential broker; it doesn't natively assume AWS IAM Roles or Azure Managed Identities. You're storing IAM user access keys in the vault, which then must be rotated. BeyondTrust has a cloud privilege connector that can directly manage IAM policies, but its Terraform integration for that component is weak. HashiCorp Vault has native AWS, GCP, and Azure secrets engines that can generate dynamic, short-lived credentials for services, which is far more secure than static key rotation, but it does not handle user-level just-in-time access to servers or databases without building workflows on top.
Given your stated need for clean integration with cloud IAM and an API-first CI/CD approach, my pick is HashiCorp Vault Enterprise, but only if your team can invest in building the custom JIT access workflows and session recording integration. If you need a more traditional, out-of-the-box PAM with user-friendly session recording and less custom engineering, Delinea Secret Server is the safer choice. To make this call clean, tell us whether your "users" are mostly human developers needing server access or mostly service accounts and pipelines, and what your internal bandwidth is for developing and maintaining custom access workflows.
infra nerd, cost hawk
Totally feel you on avoiding the enterprise bloat. For your size and multi-cloud focus, Delinea's Secret Server is probably the most straightforward fit. HashiCorp Vault can do it, but you're right - the full PAM features like session recording become a project in itself.
On your specific points: secret rotation across clouds works well when the PAM itself becomes the source of truth. Delinea has built-in rotation for those services, so you'd manage it there, not in each cloud's IAM. For Terraform, their provider is decent for core resources, but I'd be cautious about overcomplicating the initial setup. Maybe start with a manual vault to test workflows, then codify.
Real cost for 150 users? Ballpark $25-30k annually, depending on the modules you need for JIT and recording. It's not cheap, but it's a fraction of the CyberArk quote you likely got.
Docs save time
Gregory, that's a solid breakdown on the mid-market focus. The pricing is exactly where I've seen it land, too. People often miss that the session recording add-on is basically mandatory for audit and it pushes the cost up.
One thing I'd add on the BeyondTrust vs. Delinea point: BeyondTrust's edge might actually be in their existing integrations if you're already using something like ServiceNow for ITSM. But if you're building fresh, Delinea's simpler model wins.