Skip to main content
Accounts are the databases and servers you want to manage through PAM. Each account stores the connection details and credentials needed to connect — hostname, port, username, password, and so on. When users connect to an account, they never see the actual credentials. The connection is proxied, credentials are injected automatically, and everything is recorded.

​
Account Types

PAM supports the following account types:
TypeWhat it connects toWeb Access
PostgreSQLPostgreSQL databases✓
MySQLMySQL databases✓
MS SQLMicrosoft SQL Server
MongoDBMongoDB databases
SSHLinux/Unix servers✓
KubernetesKubernetes clusters
AWS IAMAWS IAM roles✓
WindowsWindows servers (RDP)✓
Windows ADWindows via Active Directory✓
Each type has specific connection details. See the type-specific pages for details.

​
Adding an Account

Accounts live inside folders. To add one:
1

Start adding an account

Go to Privileged Access Management → Accounts and click Add Account.
2

Select a folder and template

Choose which folder to add the account to, then select a template. The template determines the account type and all the rules that apply.
3

Enter connection details

Provide the hostname, port, and other connection information.
4

Enter credentials

Provide the username and password (or SSH key/certificate settings).
5

Save

Click Create.

​
Connecting to an Account

Once an account exists, users with access can connect from the My Access page:

​
Web Access

Go to Privileged Access Management → My Access, find the account, and click Launch → Connect in Browser. This opens:
  • PostgreSQL / MySQL — a Data Explorer for browsing tables and a SQL Editor for running queries
  • SSH — an interactive terminal
  • AWS IAM — opens the AWS Console with federated credentials
  • Windows / Windows AD — an RDP connection to the server

​
CLI Access

Run the CLI command to start a local proxy: 
infisical pam access <folder>/<account>
The command outputs the local port to connect to. Then connect with your preferred client (psql, pgAdmin, ssh, etc.) against localhost using that port. The proxy handles authentication automatically. Flags:
FlagWhat it does
--portUse a specific local port (otherwise one is assigned automatically)
--reasonProvide a reason (if required by the template)

​
Direct Account Memberships

Most access is granted at the folder level — if you have access to the folder, you have access to all accounts in it. But sometimes you need to grant access to just one account. For that, use direct account memberships:
  1. Open the account and go to the Permissions tab
  2. Click Assign Access
  3. Select the user/group, role, and optional expiration
  4. Click Add
Direct memberships are for exceptions — a contractor who needs one specific database, or temporary elevated access to a single account.

​
Next Steps

For detailed instructions on creating and connecting to specific account types, see the type-specific pages in the sidebar.