Panama/user/agents/skills/infisical-dynamic-secrets/references/nosql-and-cache.md

Dynamic Secrets: NoSQL & Cache

Redis

Prerequisites

• A Redis user with permissions to create ACL users (often the default or admin user)

Configuration

Field	Required	Description
Secret Name	Yes	Name for this dynamic secret
Default TTL	Yes	Default lease duration
Max TTL	Yes	Maximum lease duration
Host	Yes	Redis hostname or IP address
Port	Yes	Redis port (default: 6379)
User	Yes	Admin user (often default or admin)
Password	No	Required if Redis is password-protected
CA (SSL)	No	CA certificate (common for managed Redis like AWS ElastiCache, Azure Cache)

Redis ACL Statements (Customizable)

Default creates a user with broad access. Customize for least privilege:

-- Example: Read-only access to keys with prefix "app:"
ACL SETUSER {{username}} on >{{password}} ~app:* +get +mget +scan +keys

Template variables: {{username}}, {{password}}

Lease Returns

• DB_USERNAME — Generated username
• DB_PASSWORD — Generated password

Gotchas

• Requires Redis 6+ with ACL support
• Managed Redis services (ElastiCache, Azure Cache) often require SSL — use the CA field

---

MongoDB

Prerequisites

• A MongoDB user with userAdmin or userAdminAnyDatabase role
• Important: For MongoDB Atlas, use the separate MongoDB Atlas dynamic secret provider — standard MongoDB commands are not supported by Atlas

Configuration

Field	Required	Description
Secret Name	Yes	Name for this dynamic secret
Default TTL	Yes	Default lease duration
Max TTL	Yes	Maximum lease duration
Host	Yes	MongoDB host URL
Port	No	Omit if using a cluster/replica set connection string
User	Yes	Admin user with userAdmin privileges
Password	Yes	Admin user password
Database Name	Yes	Target database for the dynamic user
Roles	Yes	List of MongoDB roles to assign
CA (SSL)	No	CA certificate for TLS connections

MongoDB Roles

Built-in roles include:

• read, readWrite — Database-level
• dbAdmin, dbAdminAnyDatabase — Admin
• readAnyDatabase, readWriteAnyDatabase — Cross-database
• clusterMonitor, backup — Cluster operations
• Custom role names are also supported

Lease Returns

• DB_USERNAME — Generated username
• DB_PASSWORD — Generated password

Gotchas

• MongoDB vs Atlas: Use the standard MongoDB provider for self-hosted MongoDB. Use the MongoDB Atlas provider for Atlas clusters — they use different APIs.
• Port is optional because cluster connection strings include the port

---

Elasticsearch

Prerequisites

• An Elasticsearch user with privileges to create/delete users and roles

Configuration

Field	Required	Description
Secret Name	Yes	Name for this dynamic secret
Default TTL	Yes	Default lease duration
Max TTL	Yes	Maximum lease duration
Host	Yes	Elasticsearch host URL
Port	Yes	Elasticsearch port (default: 9200)
User	Yes	Admin user
Password	Yes	Admin user password
Roles	Yes	Elasticsearch roles to assign
CA (SSL)	No	CA certificate for HTTPS connections

Lease Returns

• DB_USERNAME — Generated username
• DB_PASSWORD — Generated password

---

RabbitMQ

Prerequisites

• A RabbitMQ user with administrator tag for management API access

Configuration

Field	Required	Description
Secret Name	Yes	Name for this dynamic secret
Default TTL	Yes	Default lease duration
Max TTL	Yes	Maximum lease duration
Host	Yes	RabbitMQ management API host
Port	Yes	Management API port (default: 15672)
User	Yes	Admin user
Password	Yes	Admin user password
Virtual Host	Yes	RabbitMQ virtual host
Tags	No	User tags (e.g., monitoring, management)
Permissions	No	Configure, write, read regex patterns

Lease Returns

• DB_USERNAME — Generated username
• DB_PASSWORD — Generated password