# Configure Privileged Access Manager for evict operation

This page describes how to set up Privileged Access Manager to evict LUNs and storage volumes.

Privileged Access Manager ensures that critical operations on sensitive resources, like
permanently deleting LUNs and storage volumes, are only performed with a valid
justification and for a limited time. For more information, see
[Privileged Access Manager overview](https://docs.cloud.google.com/iam/docs/pam-overview).

Only a project owner or an Identity and Access Management (IAM) administrator can create a
custom role, set up Privileged Access Manager, create an entitlement, and approve or deny a
grant request.

> [!CAUTION]
> **Important:** We recommend that you grant temporary elevated access only to principals who are authorized to carry out the evict operation. Avoid granting access to everyone in your organization as it might result in accidental permanent deletion of your storage volumes.

<br />

## Before you begin

- Create a custom IAM role with the following permissions:

  - `baremetalsolution.volumes.onDemandEvict`
  - `baremetalsolution.luns.onDemandEvict`

  To learn how to create a custom role, see [Create and manage custom roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles).
- [Set up Privileged Access Manager and grant required permissions](https://docs.cloud.google.com/iam/docs/pam-permissions-and-setup).

## Create an entitlement

[Create an entitlement](https://docs.cloud.google.com/iam/docs/pam-create-entitlements) for Bare Metal Solution evict
operation with the following information:

- Custom role that you created for the evict operation in [Before you begin](https://docs.cloud.google.com/bare-metal/docs/bms-configure-pam#before-you-begin).
- Maximum duration for a grant. For example, 2 hours.
- Approval Requirement: We recommended that you set mandatory approver requirement to authorize the request.

## Request Elevated Access

If you're a user who needs to perform evict operation, you can
[request a grant](https://docs.cloud.google.com/iam/docs/pam-request-temporary-elevated-access#request-grant)
against the Bare Metal Solution evict operation entitlement with a justification.

You can check your [grant request status](https://docs.cloud.google.com/iam/docs/pam-request-temporary-elevated-access#check-status).

## Approve or deny grant

After you request a grant, the approver specified in the entitlement receives
your grant request. Once the approver approves the request, your access is
activated.

If you're an approver, to learn how to approve a grant, see
[Approve or deny grants using Google Cloud console](https://docs.cloud.google.com/iam/docs/pam-approve-deny-grants#approve-deny-console).