Skip to main content
Agent Vault session logs record every request an AI agent makes. Organizations can store them in their own S3 bucket, called external storage, or in default storage: one S3 bucket that you set up for the whole instance. After you set up default storage, organizations on your instance can record session logs with nothing to set up.

​
Prerequisites

​
Step 1: Create the bucket

Create a general purpose S3 bucket for session logs. Directory buckets don’t work. Keep Block all public access turned on, because browsers download session logs through signed links that don’t need public access.

​
Step 2: Add a CORS rule

Browsers download session logs directly from the bucket, so the bucket has to accept requests from your Infisical URL.
1
In the Amazon S3 console, open the bucket, go to Permissions, and select Edit under Cross-origin resource sharing (CORS).
2
Paste this rule with your instance’s URL in AllowedOrigins, then select Save changes:

​
Step 3: Add lifecycle rules

Infisical tags each session log with the retention period of the organization’s plan, as retention=<days>d. The retention period is 30 days unless your license sets a different one. Infisical doesn’t delete files itself: an S3 Lifecycle rule for each tag deletes them. Add one rule for retention=30d, and one more rule for each other retention period your license uses. If no rule matches a tag, the files with that tag are never deleted.
1
In the Amazon S3 console, open the bucket, go to Management, and select Create lifecycle rule.
2
Enter a Lifecycle rule name, such as session-logs-30d, and select Limit the scope of this rule using one or more filters.
3
Under Object tags, select Add tag, and enter retention as the key and 30d as the value.
4
Under Lifecycle rule actions, select Expire current versions of objects, and enter 30 in Days after object creation.If the bucket has versioning turned on, also select Permanently delete noncurrent versions of objects, or expired session logs stay in the bucket as noncurrent versions.
5
Select Create rule.

​
Step 4: Give Infisical access to the bucket

Infisical stores session logs under <prefix>/ in the bucket, where <prefix> is the optional OBJECT_STORAGE_S3_PREFIX you set in Step 5. Create this IAM policy, with your bucket and prefix in place of the placeholders:
If you won’t set a prefix, delete <prefix>/ in both places. Infisical needs s3:PutObjectTagging to add the retention tag to each upload. Attach the policy to the identity Infisical uses for default storage:
  • The role your Infisical instances already run as, such as an EC2 instance profile or an EKS service account role
  • An IAM user whose access key you set in Step 5

​
Step 5: Configure Infisical

Set these environment variables on every Infisical instance, then restart the instances:
If you leave out the access key variables, Infisical finds credentials the way the AWS SDK does by default, for example from the instance’s role. If you set only some of the variables, such as a bucket without a region or an access key ID without its secret, Infisical doesn’t start, and its log names the missing variable.
If your instance runs in FIPS mode, Infisical reaches the bucket through the S3 FIPS endpoint of the bucket’s region, so choose a region that has one.

​
Check default storage

In an organization on your instance, go to Agent Vault, then Administration > Settings. The Session Logs card shows that session logs are on in default storage. When Infisical starts, it checks that it can list the bucket, write a tagged test file under <prefix>/ and read it back, and that the bucket’s CORS rule allows downloads from your SITE_URL. If a check fails, Infisical logs an error that names the step, such as a missing s3:PutObjectTagging, a missing s3:GetObject or a missing CORS rule. Organizations don’t see this error, so check the Infisical logs after you set up the bucket.