> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PostgreSQL credential rotation for PAM

> Rotate the passwords of PostgreSQL accounts.

This page covers what's specific to rotating the password of a [PostgreSQL account](https://infisical.com/docs/documentation/platform/pam/accounts/postgresql.md). To turn on rotation and set a rotation account, see [Credential rotation](https://infisical.com/docs/documentation/platform/pam/credential-rotation/overview.md).

## Rotation account

The rotation account needs permission to change the target role's password:

* **The account itself:** A role can always change its own password, so it needs no extra privileges
* **A different account:** The rotation account needs the `CREATEROLE` attribute, or must be a superuser

For example, to create a rotation role and a role for it to rotate:

```sql theme={"dark"}
-- the role that Infisical signs in as to rotate passwords
CREATE ROLE infisical_rotator WITH LOGIN PASSWORD '<temporary-password>' CREATEROLE;

-- the role whose password Infisical rotates
CREATE ROLE app_user WITH LOGIN PASSWORD '<temporary-password>';
```

On PostgreSQL 16 and later, a `CREATEROLE` role can only change the password of a role it has `ADMIN OPTION` on. Grant it with:

```sql theme={"dark"}
GRANT app_user TO infisical_rotator WITH ADMIN OPTION;
```

Add both roles to Infisical PAM as PostgreSQL accounts with the same host and port, then select `infisical_rotator` as the rotation account on the `app_user` account's **Rotation** tab.

## How the password is changed

Infisical signs in as the rotation account, using the account's connection details and SSL settings, and runs:

```sql theme={"dark"}
ALTER USER "<target-role>" WITH PASSWORD '<generated-password>';
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.