Skip to main content
Templates define how accounts behave when someone connects — session duration limits, MFA requirements, which Gateway to use, where to store session recordings, and more. Every account requires a template. When you create an account, you select a template, and the account inherits everything from it. Change the template later, and every account using it updates automatically. Infisical provides default templates for each account type with sensible defaults, so you can start adding accounts right away. Create custom templates when you need different rules — for example, stricter session limits for production or a specific Gateway for a network segment.

​
Default Templates

When you first use PAM, default templates are available for each account type (PostgreSQL, MySQL, MS SQL, MongoDB, SSH, Kubernetes, AWS IAM, Windows, Windows AD). Each has sensible defaults like 1-hour session duration. If the defaults work for you, you can skip straight to adding accounts.

​
Creating a Custom Template

If you need different rules — say, 4-hour sessions with MFA for production — create a custom template.
1

Navigate to Account Templates

Go to Privileged Access Management → Account Templates and click Create Template.
2

Set the basics

FieldDescription
NameA descriptive name (e.g., prod-postgres)
TypeThe account type (PostgreSQL, MySQL, SSH, etc.)
DescriptionOptional context about when to use this template
3

Configure policies

OptionWhat it does
Require MFAUsers must re-authenticate with MFA before connecting
Require ReasonUsers must provide a reason before connecting
Max Session DurationHow long someone can stay connected (in seconds)
Command BlockingRegex patterns for commands to reject (one per line). Currently SSH only.
4

Configure system settings

OptionWhat it does
GatewayDefault Gateway for connections (can be overridden per account)
Storage BackendWhere to store session recordings (internal or your S3 bucket)
Session Log MaskingRegex patterns for content to mask in recordings (one per line)
5

Save

Click Create. The template is now available when adding accounts.

​
How Templates Work with Accounts

Every account references a template. The account inherits everything from that template — session limits, MFA requirements, Gateway, recording storage, and so on. This means you can:
  • Apply the same rules to many accounts by having them use the same template
  • Change rules for all those accounts at once by editing the template
  • Have different accounts in the same folder use different templates (if they need different rules)
Some options like Gateway can be overridden at the account level when needed.

​
Next Steps

With templates set up, you’re ready to add accounts to your folders.

PostgreSQL Accounts

Add PostgreSQL database accounts.

SSH Accounts

Add SSH server accounts.