External Storage

By default, session recordings are stored in Infisical’s managed database. If you need control over where recordings live — for data residency, retention policies, or compliance requirements — you can store them in your own S3 bucket instead.

Prerequisites

Before configuring external storage, you need an AWS Connection set up in your organization. This provides the credentials Infisical uses to write to your bucket. If you don’t have one, see the AWS Connection guide.

Required Permissions

The connection’s IAM role needs these permissions on the bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject"],
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::your-bucket-name"
    }
  ]
}

Configuring a Template for External Storage

External storage is set at the template level. Each template can use a different bucket if needed.

Open the template

Go to Account Templates and click on the template you want to configure.

Find Recording Storage

In System Settings, find the Recording Storage section.

Select External S3

Change from Internal to External S3.

Configure the bucket

Field	Description
AWS Connection	Select your AWS connection
Bucket Name	Your S3 bucket
Region	AWS region
Key Prefix	Optional prefix for object keys (e.g., `pam/prod/`)

Save

Click Save. Infisical validates that it can reach the bucket before saving.

CORS Configuration

For session playback to work in the browser, your bucket needs a CORS policy:

[
  {
    "AllowedHeaders": ["*"],
    "AllowedMethods": ["GET"],
    "AllowedOrigins": ["https://app.infisical.com"],
    "MaxAgeSeconds": 3600
  }
]

Replace https://app.infisical.com with your Infisical URL if you have a custom domain. To configure:

Open the bucket in AWS Console
Go to Permissions → Cross-origin resource sharing (CORS)
Add the configuration above

If CORS isn’t set up correctly, session playback will fail with a network error.

How Recordings Are Stored

Recordings are stored as encrypted chunks:

<key-prefix>/sessions/<session-id>/chunk-0.enc
<key-prefix>/sessions/<session-id>/chunk-1.enc
...

Infisical encrypts recordings before upload, so the data in your bucket is encrypted. You can add bucket-level encryption (SSE-S3 or SSE-KMS) for additional protection.

Managing Retention

Since recordings are in your bucket, you control retention. Configure S3 lifecycle rules to automatically delete or transition objects after a certain period.

This gives you full control over how long recordings are kept — essential for compliance requirements.

Privileged Access Manager

Product Reference

Prerequisites

Required Permissions

Configuring a Template for External Storage

CORS Configuration

How Recordings Are Stored

Managing Retention

Next Steps

Session Recording

Auditing

​Prerequisites

​Required Permissions

​Configuring a Template for External Storage

​CORS Configuration

​How Recordings Are Stored

​Managing Retention

​Next Steps

Session Recording

Auditing

Prerequisites

Required Permissions

Configuring a Template for External Storage

CORS Configuration

How Recordings Are Stored

Managing Retention

Next Steps