AWS IAM accounts let you manage access to AWS through IAM role assumption. Users can open the AWS console directly or use the CLI to get temporary credentials, and every access is logged.
AWS IAM accounts do not require a Gateway — Infisical connects directly to AWS.
Creating an Account
Start adding an account
Go to Privileged Access Management → Accounts and click Add Account .
Select a folder and template
Choose which folder to add the account to, then select an AWS IAM template .
Enter connection details
Field Description Name A descriptive name (e.g., prod-admin-access) PAM Role ARN The ARN of the IAM role that Infisical assumes to broker access
Enter credentials
Field Description Target Role ARN The ARN of the IAM role the user will assume
How It Works When a user accesses an AWS IAM account:
Infisical assumes the PAM Role (configured at the account level)
Using that role, Infisical assumes the Target Role on behalf of the user
The user receives temporary AWS credentials for the target role
This lets you centralize access control through Infisical while using standard AWS IAM roles.
Connecting
Go to Privileged Access Management → My Access
Find the account and click Launch → Connect in Browser
You’ll be taken directly to the AWS console, logged in with the target role
The CLI writes temporary credentials to your AWS credentials file as a named profile: infisical pam access my-folder/prod-admin-access
This creates a profile named infisical-pam/my-folder/prod-admin-access in ~/.aws/credentials. Use it with the AWS CLI: aws s3 ls --profile "infisical-pam/my-folder/prod-admin-access"
Or set the AWS_PROFILE environment variable: export AWS_PROFILE = "infisical-pam/my-folder/prod-admin-access" aws sts get-caller-identity
Press Ctrl+C to stop and remove the credentials profile. Flags:
--reason <reason> — provide an access reason (if required by template) Next Steps
Kubernetes Accounts Add Kubernetes cluster accounts.
Sessions View and manage sessions.
