Skip to main content
infisical pam <resource-type> <subcommand> [flags]

​
Description

The infisical pam command provides privileged access management capabilities for securely accessing databases, SSH servers, Kubernetes clusters, and Redis instances through Infisical’s Gateway. All PAM commands require the user to be logged in via infisical login.

​
Command Structure

infisical pam
├── db
│   └── access       (start local database proxy)
├── ssh
│   ├── access       (start interactive SSH session)
│   ├── exec         (execute single command over SSH)
│   └── proxy        (start SSH proxy for SCP/SFTP/rsync)
├── kubernetes       (alias: k8s)
│   └── access       (start local Kubernetes proxy)
└── redis
    └── access       (start local Redis proxy)

​
Subcommands & flags

infisical pam db

Access PAM database accounts. Starts a local database proxy server that you can use to connect to databases directly (PostgreSQL, MySQL, MS SQL Server).
$ infisical pam db access --resource <resource-name> --account <account-name> [flags]

# Example
$ infisical pam db access --resource infisical-shared-cloud-instances --account infisical --project-id <project-uuid> --duration 4h

​
Flags

Name of the PAM resource to access.
# Example
infisical pam db access --resource=my-database-resource --account=admin
Name of the account within the resource.
# Example
infisical pam db access --resource=my-database-resource --account=admin
Project ID of the account to access. If not provided, uses the project from .infisical.json (run infisical init to configure).
# Example
infisical pam db access --resource=my-database-resource --account=admin --project-id=<project-uuid>
Duration for database access session. Supports Go duration format (e.g., 1h, 30m, 2h30m).Default value: 1h
# Example
infisical pam db access --resource=my-database-resource --account=admin --duration=4h
Port for the local database proxy server. Use 0 for auto-assign.Default value: 0
# Example
infisical pam db access --resource=my-database-resource --account=admin --port=5432
Domain of your self-hosted Infisical instance. If not specified, defaults to Infisical Cloud.
# Example
infisical pam db access --resource=my-database-resource --account=admin --domain=https://your-infisical-instance.com

​
Output

The command displays a connection string based on the database type:
Database TypeConnection String Format
PostgreSQLpostgres://<username>@localhost:<port>/<database>
MySQLmysql://<username>@localhost:<port>/<database>
MS SQL Serversqlserver://<username>@localhost:<port>?database=<database>&encrypt=false&trustServerCertificate=true
Access PAM SSH accounts. Provides interactive sessions, single command execution, and proxy mode for file transfers.
$ infisical pam ssh <subcommand> --resource <resource-name> --account <account-name> [flags]

​
Subcommands

Start an interactive SSH session to a PAM-managed SSH account. This command automatically launches an SSH client connected through the Infisical Gateway.
$ infisical pam ssh access --resource <resource-name> --account <account-name> [flags]

# Example
$ infisical pam ssh access --resource prod-servers --account root --project-id <project-uuid> --duration 1h
Execute a single command on a PAM-managed SSH account and return the output. This is useful for CI/CD pipelines and scripting where interactive sessions are not needed.
$ infisical pam ssh exec "<command>" --resource <resource-name> --account <account-name> [flags]

# Example
$ infisical pam ssh exec "ls -la /var/log" --resource prod-servers --account root --project-id <project-uuid>

# Use in a script to capture output
$ OUTPUT=$(infisical pam ssh exec "cat /etc/hostname" --resource prod-servers --account root --project-id <project-uuid>)
The exit code from the remote command is propagated to the CLI exit code, making this suitable for scripts that check command success.
ArgumentDescription
commandThe command to execute on the remote server (passed as first argument)
Start an SSH proxy without launching an interactive session. This is useful for file transfers using SCP, SFTP, rsync, or other SSH-based tools. The proxy prints connection details and waits until terminated with Ctrl+C.
$ infisical pam ssh proxy --resource <resource-name> --account <account-name> [flags]

# Example
$ infisical pam ssh proxy --resource prod-servers --account root --project-id <project-uuid>
# Output:
# SSH proxy listening on 127.0.0.1:53619
# Username: root
# Session expires: 2026-04-02T09:25:08+08:00
#
# Use this proxy with SSH, SCP, SFTP, or rsync:
#   ssh -p 53619 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@127.0.0.1
#   scp -P 53619 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null <local-file> root@127.0.0.1:<remote-path>
#
# Press Ctrl+C to stop the proxy.

​
Using the Proxy

In another terminal, use the proxy for file transfers:
# SCP file transfer
scp -P <port> -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null local-file.txt root@127.0.0.1:/remote/path/

# rsync
rsync -e "ssh -p <port> -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" local-dir/ root@127.0.0.1:/remote/path/

# SFTP
sftp -P <port> -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null root@127.0.0.1

​
Flags

All SSH subcommands share the following flags:
Name of the PAM resource to access.
# Example
infisical pam ssh access --resource=prod-servers --account=root
Name of the account within the resource.
# Example
infisical pam ssh access --resource=prod-servers --account=root
Project ID of the account to access. If not provided, uses the project from .infisical.json.
# Example
infisical pam ssh access --resource=prod-servers --account=root --project-id=<project-uuid>
Duration for SSH access session. Supports Go duration format (e.g., 1h, 30m, 2h30m).Default value: 1h
# Example
infisical pam ssh access --resource=prod-servers --account=root --duration=2h
Port for the local SSH proxy server (only applies to proxy subcommand). Use 0 for auto-assign.Default value: 0
# Example
infisical pam ssh proxy --resource=prod-servers --account=root --port=2222
Domain of your self-hosted Infisical instance. If not specified, defaults to Infisical Cloud.
# Example
infisical pam ssh access --resource=prod-servers --account=root --domain=https://your-infisical-instance.com
Access Kubernetes via a PAM-managed Kubernetes account. This command automatically launches a proxy connected to your Kubernetes cluster through the Infisical Gateway.Alias: infisical pam k8s
$ infisical pam kubernetes access --resource <resource-name> --account <account-name> [flags]

# Example
$ infisical pam kubernetes access --resource prod-cluster --account developer --project-id <project-uuid> --duration 4h

# Using the alias
$ infisical pam k8s access --resource prod-cluster --account developer --project-id <project-uuid>

​
Flags

Name of the PAM resource to access.
# Example
infisical pam kubernetes access --resource=prod-cluster --account=developer
Name of the account within the resource.
# Example
infisical pam kubernetes access --resource=prod-cluster --account=developer
Project ID of the account to access. If not provided, uses the project from .infisical.json.
# Example
infisical pam kubernetes access --resource=prod-cluster --account=developer --project-id=<project-uuid>
Duration for Kubernetes access session. Supports Go duration format (e.g., 1h, 30m, 2h30m).Default value: 1h
# Example
infisical pam kubernetes access --resource=prod-cluster --account=developer --duration=4h
Port for the local Kubernetes proxy server. Use 0 for auto-assign.Default value: 0
# Example
infisical pam kubernetes access --resource=prod-cluster --account=developer --port=8080
Domain of your self-hosted Infisical instance. If not specified, defaults to Infisical Cloud.
# Example
infisical pam kubernetes access --resource=prod-cluster --account=developer --domain=https://your-infisical-instance.com
Access PAM Redis accounts. Starts a local Redis proxy server that you can use to connect to Redis directly.
$ infisical pam redis access --resource <resource-name> --account <account-name> [flags]

# Example
$ infisical pam redis access --resource my-redis-resource --account redis-admin --duration 4h --port 6379 --project-id <project-uuid>

​
Flags

Name of the PAM resource to access.
# Example
infisical pam redis access --resource=my-redis-resource --account=redis-admin
Name of the account within the resource.
# Example
infisical pam redis access --resource=my-redis-resource --account=redis-admin
Project ID of the account to access. If not provided, uses the project from .infisical.json.
# Example
infisical pam redis access --resource=my-redis-resource --account=redis-admin --project-id=<project-uuid>
Duration for Redis access session. Supports Go duration format (e.g., 1h, 30m, 2h30m).Default value: 1h
# Example
infisical pam redis access --resource=my-redis-resource --account=redis-admin --duration=4h
Port for the local Redis proxy server. Use 0 for auto-assign.Default value: 0
# Example
infisical pam redis access --resource=my-redis-resource --account=redis-admin --port=6379
Domain of your self-hosted Infisical instance. If not specified, defaults to Infisical Cloud.
# Example
infisical pam redis access --resource=my-redis-resource --account=redis-admin --domain=https://your-infisical-instance.com