Hi everyone 👋. I'm currently designing the access control layer for our new data platform. We're hybrid: on-prem data sources, cloud data warehouse (BigQuery).
The security team wants PAM (Privileged Access Management) for service accounts and human access to production pipelines. They've narrowed it to:
* Delinea Secret Server (or their PAM suite)
* Azure AD Privileged Identity Management (PIM)
I'm trying to map this to an ETL/orchestration context. My main worries:
* **Service Account Secrets:** Airbyte connections, dbt service account keys, orchestrator credentials. Where do these live securely?
* **Just-in-Time Elevation:** For when a data engineer needs to debug a live job in production GCP project.
* **Audit Trail:** Crucial for compliance. Who accessed what secret, who elevated to what role at what time.
From my reading:
* Delinea seems very secret-focused. Does it handle Azure AD role elevation well?
* Azure PIM is native to our cloud identity, but can it manage static secrets for on-prem DBs?
Has anyone implemented either in a similar stack? I'm especially curious about the practical integration points, like:
* Retrieving a secret from Delinea in a Python-based task (Airbyte custom connector, dbt profile).
* The workflow for a human to get temporary `roles/bigquery.admin` via PIM.
Any gotchas or experiences would be super helpful. My PoC is next week 😅.
My current, naive thought for a Python function to fetch a secret (if we go Delinea):
```python
import requests
# This is just pseudo-code from their docs
def get_delinea_secret(secret_id):
token = get_oauth_token()
headers = {'Authorization': f'Bearer {token}'}
response = requests.get(f'https://secret-server/api/v1/secrets/{secret_id}', headers=headers)
# Would then parse JSON for the secret value
return response.json()['items'][0]['value']
```
But how do you securely bootstrap that initial token? Chicken-and-egg problem.
I'm a lead cloud architect at a 500-person financial services firm, managing a hybrid analytics environment similar to yours: on-prem SQL Server, Airflow on GKE, and BigQuery, where we implemented PAM for both service and human access last year.
* **1. Static Secret vs. Role Elevation Primacy:** Delinea is built for static credentials (passwords, keys, connection strings). Its core model is vault, retrieve, rotate, audit. Azure PIM is built for just-in-time role activation in Azure AD and Azure RBAC; it does not store or manage the actual secret strings for service accounts. If your primary problem is securing Airbyte and dbt service account keys, Delinea directly solves it. Azure PIM would require those secrets to be stored elsewhere (like Azure Key Vault) and then you'd need a separate mechanism to grant JIT access to the Key Vault secret, which adds a layer.
* **2. Hybrid Environment Reach:** Delinea's agents can be installed on-prem to manage secrets for local databases and systems without requiring them to have a cloud identity. Azure PIM only governs access for identities already in Azure AD. For pure cloud resource role elevation (e.g., to a *Contributor* role in your GCP project via Azure Arc or Entra ID), PIM is native. For on-prem SQL logins, Delinea has the clear advantage.
* **3. Audit Granularity and Integration:** Both provide strong audit trails, but the scope differs. In our setup, Delinea audits every secret checkout (which service account retrieved which database password, from which IP, for how long). Azure PIM audits role activation events (who became a *Privileged Role Administrator* for 2 hours). For compliance on service account secret usage, Delinea's log is the direct source of truth. For compliance on human privilege elevation in your cloud tenant, PIM's log is native and integrates directly with your existing Azure AD/Microsoft Sentinel SIEM.
* **4. Operational Overhead and Cost Model:** Azure AD PIM is part of Entra ID P2 licenses, which at my last shop were around $9/user/month and required for all users you want to manage with PIM, not just privileged ones. Delinea is licensed per privileged user or by the number of secrets, with enterprise agreements typically starting in the tens of thousands. The hidden cost for Delinea is the operational maintenance of the vault servers (or cluster) and its HA/DR setup; for Azure PIM, it's the entitlement management and access review configuration overhead, which is non-trivial for a large user base.
I'd recommend Delinea if securing and rotating static credentials for hybrid service accounts (Airbyte, dbt) is your paramount, immediate concern. Go with Azure AD PIM if your primary goal is governing human JIT elevation to cloud roles and your on-prem secrets are already managed by another vault. To make the call clean, tell us what percentage of your PAM use cases are for non-Azure-AD-joined resources and whether your security team already has a dedicated secrets vault in place.
That's a great breakdown of the core difference in models. The point about >Azure PIM only governs access for identities already in Azure AD< is crucial for hybrid. I've seen teams run into a wall when they realize their legacy on-prem service accounts for ETL jobs can't be brought into PIM's workflow without a significant identity migration project first. Delinea sits in front of those systems agnostically.
However, if the long-term strategy is to get everything onto cloud identities, starting with PIM and Key Vault might force that alignment, painful as it is. It depends on whether you're solving for today's reality or tomorrow's goal.
Keep it constructive.
Exactly. The "solve for tomorrow" argument is dangerous when it means leaving today's secrets unmanaged. Forcing PIM on a hybrid environment that isn't identity-ready creates a coverage gap you can't ignore.
You'll end up with a split system: cloud identities in PIM, on-prem/service accounts in some ad-hoc spreadsheet or local vault. That's worse than picking the agnostic tool now and planning the identity migration as a separate, properly scoped project.
Would you really want your Airbyte service account credentials in limbo for 18 months while IT figures out the AD sync?
Good question on JIT role elevation with Delinea. I'm new to this too, but from my reading, it can do JIT for *secrets*, not Azure AD roles directly. You'd need their Thycotic PAM module for that. So you might still need Azure PIM if your main JIT use case is for Azure RBAC.
The static secret point for on-prem DBs is key. PIM plus Key Vault is pure Azure. If you have non-Azure targets, that's a gap. Delinea would cover both.
How are you handling the connection from Airbyte to the secret store? Is there a native integration, or are you looking at a custom script? That's my biggest worry in our own setup.