Skip to main content
AWS IAM accounts let you manage access to AWS through IAM role assumption. Users can open the AWS console directly or use the CLI to get temporary credentials, and every access is logged. Infisical assumes the IAM role you configure directly, then returns short-lived STS credentials. Those credentials work with the AWS CLI and can also be exchanged for a federated AWS Management Console sign-in URL.
AWS IAM accounts do not require a Gateway. Infisical communicates directly with the AWS STS API.

​
How It Works

When a user accesses an AWS IAM account, Infisical assumes the account’s IAM role using AWS STS and returns the temporary credentials: There is a single role per account. Its trust policy allows Infisical to assume it, scoped by an External ID set to your Infisical Organization ID. The External ID prevents confused deputy attacks, where another Infisical customer could otherwise trick Infisical into assuming your role.

​
Prerequisites

Before adding the account in Infisical, create the IAM role in your AWS account with a trust policy that allows Infisical to assume it.
1

Create the role with a trust policy

Create an IAM role (e.g., infisical-pam-readonly) with the following trust policy. Replace <INFISICAL_AWS_ACCOUNT_ID> with the Infisical account ID for your region and <YOUR_INFISICAL_ORG_ID> with your Infisical Organization ID.
Always include the External ID condition. Without it, another Infisical customer could potentially trick Infisical into assuming your role.
Infisical AWS Account IDs:
For Dedicated Instances: Your AWS account ID differs from the ones listed above. Contact Infisical support to obtain your dedicated AWS account ID.
For Self-Hosted Instances: Use the AWS account ID where your Infisical instance is deployed. This is the account that hosts your Infisical infrastructure and will be assuming the role.
You can find your Infisical Organization ID under Organization Settings.
2

Attach permissions to the role

Attach whatever permissions policies define what this role can do in AWS. These are the permissions users receive when they access this account through Infisical.

​
Creating an Account

1

Start adding an account

Go to Privileged Access Management → Accounts and click Add Account.
2

Select a folder and template

Choose which folder to add the account to, then select an AWS IAM template.
3

Enter connection details

4

Save

Click Create.
To expose the same role in more than one folder, add an account in each folder pointing at the same Role ARN. Each account is a distinct entry that references the same underlying IAM role.

​
Session Duration

Sessions use short-lived STS credentials. The duration is bounded by the target role’s maximum session duration in AWS (MaxSessionDuration), with a minimum of 15 minutes. Requesting longer than the role allows will cause AWS to reject the request, so set the role’s MaxSessionDuration to cover the session lengths you expect.
AWS Console sessions cannot be terminated early. Once a federated URL is generated, the session remains valid until it expires. You can revoke active sessions by modifying the role’s trust policy.
All actions performed with the credentials are logged in AWS CloudTrail. The session is identified by the RoleSessionName, which includes the user’s email for attribution.

​
Connecting

  1. Go to Privileged Access Management → My Access
  2. Find the account and click Launch → Connect in Browser
  3. You’ll be taken directly to the AWS console, logged in with the role

​
Next Steps

Kubernetes Accounts

Add Kubernetes cluster accounts.

Sessions

View and manage sessions.