Skip to main content
A PostgreSQL account stores the credentials for one PostgreSQL database user. Members connect to the database in the browser or through the Infisical CLI, and Infisical records every query they run. The account can sign in with a password, or with AWS IAM authentication if the database runs on Amazon RDS or Aurora.

​
Prerequisites

​
Create the account

1
Go to Privileged Access Management > Accounts and select Add Account.
2
Select the Folder and a PostgreSQL Account Template, then select Next.
3
Enter a Name and the connection details:If you have a connection string, such as postgresql://user:password@host:5432/database, paste it into Host. Infisical fills in the other fields from the connection string, including the credentials.
4
Select the Auth Method and enter the credentials:
5
Select Create.

​
AWS IAM authentication

With AWS IAM authentication, Infisical doesn’t store a password for the database user. Instead, Infisical assumes an IAM role in your AWS account and uses it to generate a short-lived authentication token for each connection. Set up the database and the IAM role before you create the account:
1
In the RDS console, turn on IAM database authentication for the RDS instance or Aurora cluster.
2
Create the database user and grant it the rds_iam role:
3
Create an IAM role with the following trust policy:
Replace the placeholders:
  • <INFISICAL_AWS_ACCOUNT_ID>: 381492033652 for Infisical Cloud (US), 345594589636 for Infisical Cloud (EU), or the ID of the AWS account that runs your instance if you self-host Infisical
  • <YOUR_INFISICAL_ORG_ID>: your organization ID, which the tooltip on the Role ARN field shows
The sts:ExternalId condition stops other Infisical organizations from using your role, so don’t remove it.
4
Attach a policy to the role that lets it connect as the database user:
<DB_RESOURCE_ID> is the instance’s resource ID, which starts with db-, not the instance’s name. The RDS console shows the resource ID on the instance’s Configuration tab.
When you create the account, set the following fields:
  • Host: the endpoint of the RDS instance or Aurora cluster, not a CNAME or other alias, because AWS signs each token for that exact endpoint
  • SSL Enabled: always on, because IAM authentication requires TLS
  • SSL Certificate: to verify the server, turn on Reject Unauthorized and paste the RDS certificate bundle for your region, such as https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem
Accounts that use AWS IAM have no stored password, so credential rotation doesn’t apply to them. If a session fails with PAM authentication failed for user, AWS rejected the token. Check that the rds-db:connect resource ARN uses the instance’s current resource ID, the right region, and the same database user as the account.

​
Connect

To open a session, follow Connect to an account.
The browser session has a table browser, where you can view, filter, edit, and export rows, and a SQL editor for running queries.

​
Next steps

PostgreSQL credential rotation

Rotate the passwords of PostgreSQL accounts.

Sessions

Review and end the connections that people and agents make to your accounts.