The Infisical Postgres secret rotation allows you to automatically rotate your Postgres database user’s password at a predefined interval.

​
Prerequisite

  1. Create two users with the required permission in your PostgreSQL instance. We’ll refer to them as user-a and user-b.
  2. Create another PostgreSQL user with just the permission to update the passwords of user-a and user-b. We’ll refer to this user as the admin user.

To learn more about Postgres permission system, please visit this documentation.

​
How it works

  1. Infisical connects to your database using the provided admin user account.
  2. A random value is generated and the password for user-a is updated with the new value.
  3. The new password is then tested by logging into the database
  4. If test is success, it’s saved to the output secret mappings so that rest of the system gets the newly rotated value(s).
  5. The process is then repeated for user-b on the next rotation.
  6. The cycle repeats until secret rotation is deleted/stopped.

​
Rotation Configuration

1

Open Secret Rotation Page

Head over to Secret Rotation configuration page of your project by clicking on Secret Rotation in the left side bar

2

Click on PostgresSQL card

3

Provide the inputs

Admin Username
string
required

Rotator admin username

Admin password
string
required

Rotator admin password

Host
string
required

Database host url

Port
number
required

Database port number

Username1
string
required

The first username of two to rotate - user-a

Username2
string
required

The second username of two to rotate - user-b

CA
string

Optional database certificate to connect with database

4

Configure the output secret mapping

When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project.

Environment
string
required

The environment where the rotated credentials should be mapped to.

Secret Path
string
required

The secret path where the rotated credentials should be mapped to.

Interval
number
required

What interval should the credentials be rotated in days.

DB USERNAME
string
required

Select an existing secret key where the rotated database username value should be saved to.

DB PASSWORD
string
required

Select an existing select key where the rotated database password value should be saved to.

​
FAQ

Was this page helpful?

Twilio SendGridMySQL/MariaDB