Panama/user/agents/skills/infisical-dynamic-secrets/references/cloud-iam.md

Dynamic Secrets: Cloud IAM

AWS IAM

Overview

Generate on-demand AWS IAM credentials — either full IAM Users with access keys, or temporary STS credentials. Three authentication methods available.

Credential Types

IAM User — Creates a real IAM user with long-lived access keys. User is deleted when the lease expires.

Temporary Credentials — Generates short-lived STS credentials (access key + secret key + session token) via AssumeRole or GetSessionToken. No IAM user is created.

Authentication Methods

1. Assume Role (Recommended for Cloud)

Infisical assumes an IAM role in your AWS account to create credentials.

Cloud Setup:

1. Create an IAM Role in your AWS account
2. Trusted Entity: Another AWS Account
3. Infisical Account ID: 381492033652 (US) or 345594589636 (EU)
4. Recommended: Enable "Require external ID" with your Infisical Project ID
5. Attach the required permissions policy (see below)
6. Copy the Role ARN

Config fields: AWS Role ARN, AWS Region

2. IRSA (EKS)

For Infisical running on EKS — uses IAM Roles for Service Accounts.

Prerequisite: Set KUBERNETES_AUTO_FETCH_SERVICE_ACCOUNT_TOKEN=true on the Infisical instance.

Setup:

1. Create IAM OIDC provider for your EKS cluster
2. Create IAM Role trusting the OIDC provider with audience sts.amazonaws.com
3. Annotate the Infisical service account with the role ARN

Config fields: Same as Assume Role

3. Access Key (Self-hosted / non-AWS)

Direct IAM access key authentication.

Config fields: AWS Access Key, AWS Secret Key, AWS Region

IAM User Credential Config

Field	Required	Description
AWS IAM Path	No	IAM path prefix for created users
Permission Boundary	No	IAM policy ARN to use as permission boundary
AWS IAM Groups	No	Comma-separated group names to add user to
AWS Policy ARNs	No	Comma-separated policy ARNs to attach
AWS IAM Policy Document	No	Inline JSON policy document
Tags	No	Key-value tags for the IAM user

Required IAM Permissions

For IAM User credential type:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "iam:AttachUserPolicy", "iam:CreateAccessKey", "iam:CreateUser",
      "iam:DeleteAccessKey", "iam:DeleteUser", "iam:DeleteUserPolicy",
      "iam:DetachUserPolicy", "iam:GetUser", "iam:ListAccessKeys",
      "iam:ListAttachedUserPolicies", "iam:ListGroupsForUser",
      "iam:ListUserPolicies", "iam:PutUserPolicy",
      "iam:AddUserToGroup", "iam:RemoveUserFromGroup", "iam:TagUser"
    ],
    "Resource": ["*"]
  }]
}

For Temporary Credentials:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["sts:GetSessionToken", "sts:AssumeRole"],
    "Resource": ["*"]
  }]
}

AWS STS Duration Limits

Method	Max Duration
AssumeRole (temporary credentials)	1 hour (3600s)
Access Key / IRSA (GetSessionToken)	12 hours (43200s)

Infisical auto-adjusts TTL if it exceeds these limits.

Lease Returns (IAM User)

• ACCESS_KEY — AWS Access Key ID
• SECRET_ACCESS_KEY — AWS Secret Access Key
• USERNAME — IAM username

Lease Returns (Temporary Credentials)

• ACCESS_KEY — AWS Access Key ID
• SECRET_ACCESS_KEY — AWS Secret Access Key
• SESSION_TOKEN — STS session token

---

GCP IAM

Overview

Generate on-demand GCP service account access tokens via service account impersonation.

Prerequisites

• Enable IAM API and IAM Credentials API in your GCP project
• Create a GCP Service Account with the roles you want tokens to inherit
• Grant Service Account Token Creator role to Infisical's service account on your service account

Infisical Cloud service accounts:

• US: [email protected]
• EU: [email protected]

Self-hosted: Create a dedicated service account, download JSON key, set INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL env var.

Configuration

Field	Required	Description
Secret Name	Yes	Name for this dynamic secret
Default TTL	Yes	Default lease duration
Max TTL	Yes	Maximum lease duration
Service Account Email	Yes	Email of the GCP service account to impersonate

Lease Returns

• Access token (OAuth2 bearer token)

Gotchas

• GCP tokens CANNOT be revoked. Revoking a lease in Infisical removes the record, but the token remains valid until its TTL expires. Use short TTLs.
• The generated token inherits all roles assigned to the impersonated service account
• Two separate GCP APIs must be enabled (IAM API + IAM Credentials API)