Skip to main content
An AWS IAM account lets people work in AWS as an IAM role without holding long-lived access keys. When someone launches a session, Infisical assumes the role through AWS STS and gives them temporary credentials. They can open the AWS Management Console in the browser or use the credentials with the AWS CLI. AWS IAM accounts don’t use a Gateway, because Infisical calls AWS STS directly.

​
Prerequisites

  • The Admin role on the folder you’ll add the account to
  • Permission to create IAM roles in the AWS account
  • Your Infisical organization ID, which you can copy from Organization ID in your organization’s settings

​
Create an IAM role

Each account assumes one IAM role. The role’s trust policy lets Infisical assume the role only when Infisical sends your organization ID as the external ID, so no other Infisical customer can get Infisical to assume it.
1
In AWS, create an IAM role, such as infisical-pam-readonly, with the following trust policy:
Replace <infisical-aws-account-id> with the AWS account that Infisical runs in:
2
Attach permission policies to the role. People who access the account get exactly these permissions in AWS.
3
Set the role’s Maximum session duration to cover the longest session you’ll allow, as described in Session duration.

​
Create an account

1
Go to Privileged Access Management > Accounts and select Add Account.
2
Select the Folder to add the account to and an AWS IAM Account Template, such as the default aws-iam template, then select Next.
3
Enter a Name for the account and the Role ARN of the role you created, such as arn:aws:iam::123456789012:role/infisical-pam-readonly.
4
Select Create.
To offer the same role in more than one folder, create an account with the same Role ARN in each folder.

​
Session duration

A session lasts for the template’s maximum session duration, unless the person requests a shorter one. AWS rejects a session that’s shorter than 15 minutes or longer than the role’s maximum session duration, so make sure both limits allow the sessions you expect.
You can’t end an AWS Management Console session early. Terminating the session in Infisical doesn’t sign the person out of the console, which stays signed in until the session expires. To cut off access sooner, revoke the role’s active sessions in AWS.

​
Connect

To learn how to launch a session, see Connect to an account. In the browser, the session opens the AWS Management Console, signed in as the role. The CLI writes temporary credentials to ~/.aws/credentials as a profile named infisical-pam/<folder>/<account>:
Pass the profile to the AWS CLI, or set AWS_PROFILE to use it for every command:
Press Ctrl+C to end the session. The CLI then removes the profile.

​
Track activity in AWS

Infisical names each STS session after the email of the person who launched it, or after the name of the machine identity. In AWS CloudTrail, the session name shows who made each call.