PostgreSQL accounts

PostgreSQL accounts let you manage access to your PostgreSQL databases. Users connect through Web Access (a browser-based interface) or CLI (a local proxy), and every session can be recorded.

Creating an account

Start adding an account

Go to Privileged Access Management → Accounts and select Add Account.

Select a folder and template

Choose which folder to add the account to, then select a PostgreSQL template (e.g., the default postgres or a custom one).

Enter connection details

Already have a connection string? Paste it into the Host field and the remaining fields are filled in for you, credentials included. Both postgresql://user:password@host:5432/database and host=... port=... dbname=... forms work.

Field	Description
Name	A descriptive name (e.g., `orders-db-readonly`)
Host	Database hostname or IP
Port	PostgreSQL port (default: 5432)
Database	Database name
SSL Enabled	Enable SSL for the connection
Reject Unauthorized	Reject connections with invalid certificates (only if SSL enabled)
SSL Certificate	Custom CA certificate (only if SSL enabled)

Choose authentication method

PostgreSQL supports two authentication methods:

Password
AWS IAM

Standard PostgreSQL login with username and password.

Field	Description
Username	PostgreSQL username
Password	PostgreSQL password

IAM database authentication for RDS and Aurora. No password is stored.

Field	Description
Username	Database user granted the `rds_iam` role
AWS Region	Region of the RDS or Aurora instance
Role ARN	IAM role Infisical assumes to generate a token

Save

Select Create.

AWS IAM authentication

RDS and Aurora instances that require IAM database authentication use the AWS IAM auth method. No password is stored: Infisical generates a short-lived authentication token for each connection. Set the following up before creating the account.

Enable IAM authentication on the instance

Turn on IAM database authentication for the RDS instance or Aurora cluster.

Grant the database user IAM access

CREATE USER app_user WITH LOGIN;
GRANT rds_iam TO app_user;

Create the role with a trust policy

Create the IAM role you’ll set as Role ARN. Replace <INFISICAL_AWS_ACCOUNT_ID> with the Infisical account ID for your region (US 381492033652, EU 345594589636) and <YOUR_INFISICAL_ORG_ID> with your Infisical Organization ID, found under Organization Settings.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::<INFISICAL_AWS_ACCOUNT_ID>:root" },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": { "sts:ExternalId": "<YOUR_INFISICAL_ORG_ID>" }
    }
  }]
}

Always include the External ID condition. Without it, another Infisical customer could potentially trick Infisical into assuming your role.

For Self-Hosted Instances: use the AWS account ID where your Infisical instance is deployed, since that is the account assuming the role.

Attach permission to connect

Attach a policy allowing the role to connect as that database user:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "rds-db:connect",
    "Resource": "arn:aws:rds-db:<REGION>:<AWS_ACCOUNT_ID>:dbuser:<DB_RESOURCE_ID>/app_user"
  }]
}

The resource ARN uses the instance’s resource ID (db-...), not its name. Find it under Configuration on the instance in the RDS console.

Set Host to the instance’s RDS or Aurora endpoint. Tokens are signed for that exact endpoint, so a CNAME or other alias is rejected.

IAM authentication requires an encrypted connection, so SSL Enabled is turned on and can’t be disabled. To verify the server certificate, turn on Reject Unauthorized and paste your region’s RDS root certificate into SSL Certificate, for example https://truststore.pki.rds.amazonaws.com/us-east-1/us-east-1-bundle.pem.

PAM authentication failed for user means AWS rejected the token rather than the database being unreachable. Check that the role’s rds-db:connect resource ARN uses the instance’s current resource ID, region, and the same database user the account connects as.

Credential rotation doesn’t apply to these accounts, since there is no stored password.

Connecting

Web Access
CLI

Web Access provides a browser-based interface with two tools:

Data Explorer — browse tables, view data, filter and sort, edit rows, export to CSV/JSON
SQL Editor — write and run SQL queries, use transactions

To connect:

Go to Privileged Access Management → Accounts
Find the account and click the rocket icon (or select Launch Session from the menu)
Click Connect in Browser

The CLI starts a local proxy that you connect to with your preferred PostgreSQL client.

infisical pam access backend-team/orders-db

The command outputs the local port to connect to. Then use your PostgreSQL client:

psql "postgresql://localhost:<port>/orders"

No password needed since the proxy handles authentication.Flags:

--port <port> — use a specific local port (otherwise one is assigned automatically)
--reason <reason> — provide an access reason (if required by template)

Privileged access manager

Product reference

PostgreSQL accounts

Creating an account

AWS IAM authentication

Connecting

Next steps

SSH Accounts

Sessions

​Creating an account

​AWS IAM authentication

​Connecting

​Next steps

SSH Accounts

Sessions

Creating an account

AWS IAM authentication

Connecting

Next steps