> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS IAM dynamic secrets

> Learn how to dynamically generate AWS IAM Users.

The Infisical AWS IAM dynamic secret allows you to generate AWS IAM Users and temporary credentials on demand based on a configured AWS policy. Infisical supports several authentication methods to connect to your AWS account, including assuming an IAM Role, using IAM Roles for Service Accounts (IRSA) on EKS, or static Access Keys.

## AWS STS duration limits

When using **Temporary Credentials**, AWS STS has specific maximum duration limits:

* **AssumeRole operations**: Maximum 1 hour (3600 seconds) when using temporary credentials
* **GetSessionToken operations** (Access Key & IRSA): Maximum 12 hours (43200 seconds)

> [!NOTE]
>
> **Automatic Duration Adjustment**: If you specify a TTL that exceeds these AWS limits, Infisical will automatically use the maximum allowed duration instead of failing the operation. This ensures your dynamic secrets work reliably within AWS constraints.

## Prerequisite

Infisical needs an AWS IAM principal (a user or a role) with the required permissions to create and manage other IAM users and temporary credentials. This principal will be responsible for the lifecycle of the dynamically generated users and temporary credentials.

> [accordion] Required IAM Permissions
>
> > [tab] IAM User
> >
> > Required permissions for creating temporary IAM users:
> >
> > ```json theme={"dark"}
> > {
> >   "Version": "2012-10-17",
> >   "Statement": [
> >     {
> >       "Effect": "Allow",
> >       "Action": [
> >         "iam:AttachUserPolicy",
> >         "iam:CreateAccessKey",
> >         "iam:CreateUser",
> >         "iam:DeleteAccessKey",
> >         "iam:DeleteUser",
> >         "iam:DeleteUserPolicy",
> >         "iam:DetachUserPolicy",
> >         "iam:GetUser",
> >         "iam:ListAccessKeys",
> >         "iam:ListAttachedUserPolicies",
> >         "iam:ListGroupsForUser",
> >         "iam:ListUserPolicies",
> >         "iam:PutUserPolicy",
> >         "iam:AddUserToGroup",
> >         "iam:RemoveUserFromGroup",
> >         "iam:TagUser"
> >       ],
> >       "Resource": ["*"]
> >     }
> >   ]
> > }
> > ```
> >
> > To minimize managing user access you can attach a resource in format
> >
> > > arn:aws:iam::\<account-id>:user/\<aws-scope-path>
> >
> > Replace **\<account id>** with your AWS account id and **\<aws-scope-path>** with a path to minimize managing user access.
>
> > [tab] Temporary Credentials
> >
> > Required permissions for Access Key and Assume Role methods:
> >
> > ```json theme={"dark"}
> > {
> >   "Version": "2012-10-17",
> >   "Statement": [
> >     {
> >       "Effect": "Allow",
> >       "Action": [
> >         "sts:GetSessionToken",
> >         "sts:AssumeRole"
> >       ],
> >       "Resource": ["*"]
> >     }
> >   ]
> > }
> > ```
> >
> > To minimize managing user access you can attach a resource in format
> >
> > > arn:aws:iam::\<account-id>:user/\<aws-scope-path>
> >
> > Replace **\<account id>** with your AWS account id and **\<aws-scope-path>** with a path to minimize managing user access.

## Set up dynamic secrets with AWS IAM

> [tab] Assume Role (Recommended)
>
> Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.
>
> > [accordion] Self-Hosted Instance
> >
> > To connect your self-hosted Infisical instance with AWS, you need to set up an AWS IAM User account that can assume the configured AWS IAM Role.
> >
> > If your instance is deployed on AWS, the aws-sdk will automatically retrieve the credentials. Ensure that you assign the provided permission policy to your deployed instance, such as ECS or EC2.
> >
> > The following steps are for instances not deployed on AWS:
> >
> > **1. Create an IAM User**
> >
> > Navigate to [Create IAM User](https://console.aws.amazon.com/iamv2/home#/users/create) in your AWS Console.
> >
> > **2. Create an Inline Policy**
> >
> > Attach the following inline permission policy to the IAM User to allow it to assume any IAM Roles:
> >
> > ```json theme={"dark"}
> > {
> >     "Version": "2012-10-17",
> >     "Statement": [
> > {
> >     "Sid": "AllowAssumeAnyRole",
> >     "Effect": "Allow",
> >     "Action": "sts:AssumeRole",
> >     "Resource": "arn:aws:iam::*:role/*"
> > }
> >     ]
> > }
> > ```
> >
> > **3. Obtain the IAM User Credentials**
> >
> > Obtain the AWS access key ID and secret access key for your IAM User by navigating to **IAM > Users > \[Your User] > Security credentials > Access keys**.
> >
> > ![Access Key Step 1](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integrations-aws-access-key-1.png)
> >
> > ![Access Key Step 2](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integrations-aws-access-key-2.png)
> >
> > ![Access Key Step 3](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integrations-aws-access-key-3.png)
> >
> > **4. Set Up Connection Keys**
> >
> > 1. Set the access key as **DYNAMIC\_SECRET\_AWS\_ACCESS\_KEY\_ID**.
> > 2. Set the secret key as **DYNAMIC\_SECRET\_AWS\_SECRET\_ACCESS\_KEY**.
>
> **1. Create the Managing User IAM Role for Infisical**
>
> 1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
>
>    ![IAM Role Creation](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integration-aws-iam-assume-role.png)
>
> 2. Select **AWS Account** as the **Trusted Entity Type**.
>
> 3. Select **Another AWS Account** and provide the appropriate Infisical AWS Account ID: use **381492033652** for the **US region**, and **345594589636** for the **EU region**. This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
>
> > [!NOTE]
> >
> > **For Dedicated Instances**: Your AWS account ID differs from the one provided above. Please reach out to Infisical support to obtain your AWS account ID.
>
> 4. (Recommended) **Enable "Require external ID"** and input your **Project ID** to strengthen security and mitigate the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html).
>
> 5. Assign permission as shared in prerequisite.
>
> > [!WARNING]
> >
> > When configuring an IAM Role that Infisical will assume, it’s highly recommended to enable the **"Require external ID"** option and specify your **Project ID**.
> >
> > This precaution helps protect your AWS account against the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html), a potential security vulnerability where Infisical could be tricked into performing actions on your behalf by an unauthorized actor.
> >
> > **Always enable "Require external ID" and use your Project ID when setting up the IAM Role.**
>
> **2. Copy the AWS IAM Role ARN**
>
> ![Copy IAM Role ARN](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/integration-aws-iam-assume-arn.png)
>
> **3. Secret Overview Dashboard**
>
> Navigate to the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret to.
>
> **4. Click on the 'Add Dynamic Secret' button**
>
> ![Add Dynamic Secret Button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/add-dynamic-secret-button.png)
>
> **5. Select AWS IAM**
>
> ![Dynamic Secret Modal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-modal-aws-iam.png)
>
> **6. Provide the inputs for dynamic secret parameters**
>
> ![Dynamic Secret Setup Modal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-setup-modal-aws-iam-assume-role.png)
>
> **Secret Name** `string` *required*
>
> Name by which you want the secret to be referenced
>
> **Default TTL** `string` *required*
>
> Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
>
> **Max TTL** `string` *required*
>
> Maximum time-to-live for a generated secret
>
> **Username Template** `string` (default: \{\{randomUsername}})
>
> Specifies a template for generating usernames. This field allows customization of how usernames are automatically created.
>
> Allowed template variables are:
>
> * `{{randomUsername}}`: Random username string.
> * `{{unixTimestamp}}`: Current Unix timestamp at the time of lease creation.
> * `{{identity.name}}`: Name of the identity that is generating the lease.
> * `{{dynamicSecret.name}}`: Name of the associated dynamic secret.
> * `{{dynamicSecret.type}}`: Type of the associated dynamic secret.
> * `{{random N}}`: Random string of N characters.
>
> Allowed template functions are:
>
> * `truncate`: Truncates a string to a specified length.
> * `replace`: Replaces a substring with another value.
> * `uppercase`: Converts a string to uppercase.
> * `lowercase`: Converts a string to lowercase.
>
> Examples:
>
> ```yaml theme={"dark"}
> {{ randomUsername }}                                            // 3POnzeFyK9gW2nioK0q2gMjr6CZqsRiX
> {{ unixTimestamp }}                                             // 17490641580
> {{ identity.name }}                                             // <identity-name>
> {{ random 5 }}                                                  // x9K2m
> {{ truncate identity.name 4 }}                                  // test
> {{ replace identity.name '<identity-name>' 'new-value' }}       // new-value
> ```
>
> **Tags** `map\<string, string\>[]`
>
> Tags to be added to the created IAM User resource.
>
> **Method** `string` *required*
>
> Select *Assume Role* method.
>
> **Credential Type** `string` *required*
>
> Choose the credential generation approach:
>
> * **IAM User (Default)**: Creates new temporary IAM users in your AWS account
> * **Temporary Credentials**: Generates temporary credentials from your role connection
>
> **Aws Role ARN** `string` *required*
>
> The ARN of the AWS Role to assume.
>
> **AWS Region** `string` *required*
>
> The AWS data center region.
>
> > [tab] IAM User
> >
> > **AWS IAM Path** `string`
> >
> > [IAM AWS Path](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/) to scope created IAM User resource access.
> >
> > **IAM User Permission Boundary** `string`
> >
> > The IAM Policy ARN of the [AWS Permissions Boundary](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) to attach to IAM users created in the role.
> >
> > **AWS IAM Groups** `string`
> >
> > The AWS IAM groups that should be assigned to the created users. Multiple values can be provided by separating them with commas.
> >
> > **AWS Policy ARNs** `string`
> >
> > The AWS IAM managed policies that should be attached to the created users. Multiple values can be provided by separating them with commas. AWS allows at most 10 managed policies attached to a user.
> >
> > **AWS IAM Policy Document** `string`
> >
> > The AWS IAM inline policy (JSON) that should be attached to the created users. Maximum 2,048 non-whitespace characters (AWS excludes whitespace from this quota).
> >
> > **Username Template** `string` (default: \{\{randomUsername}})
> >
> > Specifies a template for generating usernames. This field allows customization of how usernames are automatically created.
> >
> > Allowed template variables are:
> >
> > * `{{randomUsername}}`: Random username string.
> > * `{{unixTimestamp}}`: Current Unix timestamp at the time of lease creation.
> > * `{{identity.name}}`: Name of the identity that is generating the lease.
> > * `{{dynamicSecret.name}}`: Name of the associated dynamic secret.
> > * `{{dynamicSecret.type}}`: Type of the associated dynamic secret.
> > * `{{random N}}`: Random string of N characters.
> >
> > Allowed template functions are:
> >
> > * `truncate`: Truncates a string to a specified length.
> > * `replace`: Replaces a substring with another value.
> > * `uppercase`: Converts a string to uppercase.
> > * `lowercase`: Converts a string to lowercase.
> >
> > Examples:
> >
> > ```yaml theme={"dark"}
> > {{ randomUsername }}                                            // 3POnzeFyK9gW2nioK0q2gMjr6CZqsRiX
> > {{ unixTimestamp }}                                             // 17490641580
> > {{ identity.name }}                                             // <identity-name>
> > {{ random 5 }}                                                  // x9K2m
> > {{ truncate identity.name 4 }}                                  // test
> > {{ replace identity.name '<identity-name>' 'new-value' }}       // new-value
> > ```
> >
> > **Tags** `map\<string, string\>[]`
> >
> > Tags to be added to the created IAM User resource.
>
> > [tab] Temporary Credentials
> >
> > When **Credential Type** is set to **Temporary Credentials**:
> >
> > > [!NOTE]
> > >
> > > The generated credentials will:
> > >
> > > * Inherit the permissions of the assumed role, optionally restricted by the session policies below
> > > * Include an AWS Session Token
> > > * Be valid for the duration specified in Default TTL
> >
> > **AWS Session Policy ARNs** `string`
> >
> > Comma-separated managed policy ARNs applied as session policies. The generated credentials are limited to the intersection of the assumed role's permissions and these policies. AWS allows up to 10 ARNs.
> >
> > **AWS Session Policy Document** `string`
> >
> > An inline session policy (JSON) that further restricts the generated credentials. Maximum 2,048 characters of plaintext. AWS additionally enforces a packed-size limit covering the inline policy, managed policy ARNs, and session tags combined.
> >
> > > [!NOTE]
> > >
> > > Session policies can only restrict the assumed role's permissions; they can never grant permissions beyond it.
> >
> > > [!WARNING]
> > >
> > > **Duration Limit**: AssumeRole temporary credentials are limited to 1 hour maximum by AWS. TTL values exceeding this limit will be automatically adjusted to 1 hour.
> >
> > ![Dynamic Secret Setup Modal Temporary Credentials](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/aws-iam-temporary-credentials.png)
>
> **7. Click 'Submit'**
>
> After submitting the form, you will see a dynamic secret created in the dashboard.
>
> ![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret.png)
>
> **8. Generate dynamic secrets**
>
> Once you've successfully configured the dynamic secret, you're ready to generate on-demand credentials.
> To do this, simply click on the 'Generate' button which appears when hovering over the dynamic secret item.
> Alternatively, you can initiate the creation of a new lease by selecting 'New Lease' from the dynamic secret lease list section.
>
> ![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-generate.png)
>
> ![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-lease-empty.png)
>
> When generating these secrets, it's important to specify a Time-to-Live (TTL) duration. This will dictate how long the credentials are valid for.
>
> ![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/provision-lease.png)
>
> > [!TIP]
> >
> > Ensure that the TTL for the lease falls within the maximum TTL defined when configuring the dynamic secret in step 4.
>
> Once you click the `Submit` button, a new secret lease will be generated and the credentials for it will be shown to you.
>
> **Credentials format depends on your chosen credential type:**
>
> **IAM User credential type:**
>
> * AWS Username
> * AWS Access Key ID
> * AWS Secret Access Key
>
> **Temporary Credentials credential type:**
>
> * AWS Access Key ID
> * AWS Secret Access Key
> * AWS Session Token
>
>   ![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/lease-values-aws-iam.png)

> [tab] IRSA (EKS)
>
> This method is recommended for self-hosted Infisical instances running on AWS EKS. It uses [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) to securely grant permissions to the Infisical pods without managing static credentials.
>
> > [!WARNING]
> >
> > In order to use IRSA, the `KUBERNETES_AUTO_FETCH_SERVICE_ACCOUNT_TOKEN` environment variable must be set to `true` for your self-hosted Infisical instance.
>
> **1. Create an IAM OIDC provider for your cluster**
>
> If you don't already have one, you need to create an IAM OIDC provider for your EKS cluster. This allows IAM to trust authentication tokens from your Kubernetes cluster.
>
> 1. Find your cluster's OIDC provider URL from the EKS console or by using the AWS CLI:
>    `aws eks describe-cluster --name <your-cluster-name> --query "cluster.identity.oidc.issuer" --output text`
> 2. Navigate to the [IAM Identity Providers](https://console.aws.amazon.com/iam/home#/providers) page in your AWS Console and create a new OpenID Connect provider with the URL and `sts.amazonaws.com` as the audience.
>
>    ![Create OIDC Provider Placeholder](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/irsa-create-oidc-provider.png)
>
> **2. Create the Managing User IAM Role for Infisical**
>
> 1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
> 2. Select **Web identity** as the **Trusted Entity Type**.
> 3. Choose the OIDC provider you created in the previous step.
> 4. For the **Audience**, select `sts.amazonaws.com`.
>
>    ![IAM Role Creation for IRSA](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/integrations/aws/irsa-iam-role-creation.png)
> 5. Attach the permission policy detailed in the **Prerequisite** section at the top of this page.
> 6. After creating the role, edit its **Trust relationship** to specify the service account Infisical is using in your cluster. This ensures only the Infisical pod can assume this role.
>
> ```json theme={"dark"}
> {
>     "Version": "2012-10-17",
>     "Statement": [
>         {
>             "Effect": "Allow",
>             "Principal": {
>                 "Federated": "arn:aws:iam::<ACCOUNT_ID>:oidc-provider/oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>"
>             },
>             "Action": "sts:AssumeRoleWithWebIdentity",
>             "Condition": {
>                 "StringEquals": {
>                     "oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:sub": "system:serviceaccount:<K8S_NAMESPACE>:<INFISICAL_SERVICE_ACCOUNT_NAME>",
>                     "oidc.eks.<REGION>.amazonaws.com/id/<OIDC_ID>:aud": "sts.amazonaws.com"
>                 }
>             }
>         }
>     ]
> }
> ```
>
> Replace `<ACCOUNT_ID>`, `<REGION>`, `<OIDC_ID>`, `<K8S_NAMESPACE>`, and `<INFISICAL_SERVICE_ACCOUNT_NAME>` with your specific values.
>
> **3. Annotate the Infisical Kubernetes Service Account**
>
> For the IRSA mechanism to work, the Infisical service account in your Kubernetes cluster must be annotated with the ARN of the IAM role you just created.
>
> Run the following command, replacing the placeholders with your values:
>
> ```bash theme={"dark"}
> kubectl annotate serviceaccount -n <infisical-namespace> <infisical-service-account> \
> eks.amazonaws.com/role-arn=arn:aws:iam::<account-id>:role/<iam-role-name>
> ```
>
> This annotation tells the EKS Pod Identity Webhook to inject the necessary environment variables and tokens into the Infisical pod, allowing it to assume the specified IAM role.
>
> **4. Secret Overview Dashboard**
>
> Navigate to the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret to.
>
> **5. Click on the 'Add Dynamic Secret' button**
>
> ![Add Dynamic Secret Button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/add-dynamic-secret-button.png)
>
> **6. Select AWS IAM**
>
> ![Dynamic Secret Modal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-modal-aws-iam.png)
>
> **7. Provide the inputs for dynamic secret parameters**
>
> ![Dynamic Secret Setup Modal for IRSA](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-setup-modal-aws-iam-irsa.png)
>
> **Secret Name** `string` *required*
>
> Name by which you want the secret to be referenced
>
> **Default TTL** `string` *required*
>
> Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
>
> **Max TTL** `string` *required*
>
> Maximum time-to-live for a generated secret
>
> **Username Template** `string` (default: \{\{randomUsername}})
>
> Specifies a template for generating usernames. This field allows customization of how usernames are automatically created.
>
> Allowed template variables are:
>
> * `{{randomUsername}}`: Random username string.
> * `{{unixTimestamp}}`: Current Unix timestamp at the time of lease creation.
> * `{{identity.name}}`: Name of the identity that is generating the lease.
> * `{{dynamicSecret.name}}`: Name of the associated dynamic secret.
> * `{{dynamicSecret.type}}`: Type of the associated dynamic secret.
> * `{{random N}}`: Random string of N characters.
>
> Allowed template functions are:
>
> * `truncate`: Truncates a string to a specified length.
> * `replace`: Replaces a substring with another value.
> * `uppercase`: Converts a string to uppercase.
> * `lowercase`: Converts a string to lowercase.
>
> Examples:
>
> ```yaml theme={"dark"}
> {{ randomUsername }}                                            // 3POnzeFyK9gW2nioK0q2gMjr6CZqsRiX
> {{ unixTimestamp }}                                             // 17490641580
> {{ identity.name }}                                             // <identity-name>
> {{ random 5 }}                                                  // x9K2m
> {{ truncate identity.name 4 }}                                  // test
> {{ replace identity.name '<identity-name>' 'new-value' }}       // new-value
> ```
>
> **Tags** `map\<string, string\>[]`
>
> Tags to be added to the created IAM User resource.
>
> **Method** `string` *required*
>
> Select *IRSA* method.
>
> **Credential Type** `string` *required*
>
> Choose the credential generation approach:
>
> * **IAM User**: Creates new temporary IAM users in your AWS account
> * **Temporary Credentials**: Generates temporary credentials from your IRSA role connection
>
> **Aws Role ARN** `string` *required*
>
> The ARN of the AWS IAM Role for the service account to assume.
>
> **AWS Region** `string` *required*
>
> The AWS data center region.
>
> > [tab] IAM User
> >
> > **AWS IAM Path** `string`
> >
> > [IAM AWS Path](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/) to scope created IAM User resource access.
> >
> > **IAM User Permission Boundary** `string`
> >
> > The IAM Policy ARN of the [AWS Permissions Boundary](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) to attach to IAM users created in the role.
> >
> > **AWS IAM Groups** `string`
> >
> > The AWS IAM groups that should be assigned to the created users. Multiple values can be provided by separating them with commas.
> >
> > **AWS Policy ARNs** `string`
> >
> > The AWS IAM managed policies that should be attached to the created users. Multiple values can be provided by separating them with commas. AWS allows at most 10 managed policies attached to a user.
> >
> > **AWS IAM Policy Document** `string`
> >
> > The AWS IAM inline policy (JSON) that should be attached to the created users. Maximum 2,048 non-whitespace characters (AWS excludes whitespace from this quota).
> >
> > **Username Template** `string` (default: \{\{randomUsername}})
> >
> > Specifies a template for generating usernames. This field allows customization of how usernames are automatically created.
> >
> > Allowed template variables are:
> >
> > * `{{randomUsername}}`: Random username string.
> > * `{{unixTimestamp}}`: Current Unix timestamp at the time of lease creation.
> > * `{{identity.name}}`: Name of the identity that is generating the lease.
> > * `{{dynamicSecret.name}}`: Name of the associated dynamic secret.
> > * `{{dynamicSecret.type}}`: Type of the associated dynamic secret.
> > * `{{random N}}`: Random string of N characters.
> >
> > Allowed template functions are:
> >
> > * `truncate`: Truncates a string to a specified length.
> > * `replace`: Replaces a substring with another value.
> > * `uppercase`: Converts a string to uppercase.
> > * `lowercase`: Converts a string to lowercase.
> >
> > Examples:
> >
> > ```yaml theme={"dark"}
> > {{ randomUsername }}                                            // 3POnzeFyK9gW2nioK0q2gMjr6CZqsRiX
> > {{ unixTimestamp }}                                             // 17490641580
> > {{ identity.name }}                                             // <identity-name>
> > {{ random 5 }}                                                  // x9K2m
> > {{ truncate identity.name 4 }}                                  // test
> > {{ replace identity.name '<identity-name>' 'new-value' }}       // new-value
> > ```
> >
> > **Tags** `map\<string, string\>[]`
> >
> > Tags to be added to the created IAM User resource.
>
> > [tab] Temporary Credentials
> >
> > When **Credential Type** is set to **Temporary Credentials**:
> >
> > > [!NOTE]
> > >
> > > No additional configuration parameters are required. The generated credentials will:
> > >
> > > * Inherit the permissions of the assumed IRSA role
> > > * Include an AWS Session Token
> > > * Be valid for the duration specified in Default TTL
> >
> > > [!NOTE]
> > >
> > > **Duration Limit**: IRSA temporary credentials support up to 12 hours maximum via GetSessionToken. TTL values exceeding this limit will be automatically adjusted.
> >
> > > [!NOTE]
> > >
> > > Session policies (AWS Session Policy ARNs / AWS Session Policy Document) are not supported with the IRSA method: STS GetSessionToken does not accept them. These fields are only available with the Assume Role method.
>
> **8. Click 'Submit'**
>
> After submitting the form, you will see a dynamic secret created in the dashboard.
>
> ![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret.png)
>
> **9. Generate dynamic secrets**
>
> Once you've successfully configured the dynamic secret, you're ready to generate on-demand credentials.
> To do this, simply click on the 'Generate' button which appears when hovering over the dynamic secret item.
> Alternatively, you can initiate the creation of a new lease by selecting 'New Lease' from the dynamic secret lease list section.
>
> ![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-generate.png)
>
> ![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-lease-empty.png)
>
> When generating these secrets, it's important to specify a Time-to-Live (TTL) duration. This will dictate how long the credentials are valid for.
>
> ![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/provision-lease.png)
>
> > [!TIP]
> >
> > Ensure that the TTL for the lease falls within the maximum TTL defined when configuring the dynamic secret in step 4.
>
> Once you click the `Submit` button, a new secret lease will be generated and the credentials for it will be shown to you.
>
> ![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/lease-values-aws-iam.png)

> [tab] Access Key
>
> Infisical will use the provided **Access Key ID** and **Secret Key** to connect to your AWS instance.
>
> **1. Secret Overview Dashboard**
>
> Navigate to the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret to.
>
> **2. Click on the 'Add Dynamic Secret' button**
>
> ![Add Dynamic Secret Button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/add-dynamic-secret-button.png)
>
> **3. Select AWS IAM**
>
> ![Dynamic Secret Modal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-modal-aws-iam.png)
>
> **4. Provide the inputs for dynamic secret parameters**
>
> ![Dynamic Secret Setup Modal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-setup-modal-aws-iam-access-key.png)
>
> **Secret Name** `string` *required*
>
> Name by which you want the secret to be referenced
>
> **Default TTL** `string` *required*
>
> Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated)
>
> **Max TTL** `string` *required*
>
> Maximum time-to-live for a generated secret
>
> **Method** `string` *required*
>
> Select *Access Key* method.
>
> **Credential Type** `string` *required*
>
> Choose the credential generation approach:
>
> * **IAM User**: Creates new temporary IAM users in your AWS account
> * **Temporary Credentials**: Generates temporary credentials from your access key connection
>
> **AWS Access Key** `string` *required*
>
> The managing AWS IAM User Access Key
>
> **AWS Secret Key** `string` *required*
>
> The managing AWS IAM User Secret Key
>
> **AWS Region** `string` *required*
>
> The AWS data center region.
>
> > [tab] IAM User
> >
> > **AWS IAM Path** `string`
> >
> > [IAM AWS Path](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/) to scope created IAM User resource access.
> >
> > **IAM User Permission Boundary** `string`
> >
> > The IAM Policy ARN of the [AWS Permissions Boundary](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) to attach to IAM users created in the role.
> >
> > **AWS IAM Groups** `string`
> >
> > The AWS IAM groups that should be assigned to the created users. Multiple values can be provided by separating them with commas.
> >
> > **AWS Policy ARNs** `string`
> >
> > The AWS IAM managed policies that should be attached to the created users. Multiple values can be provided by separating them with commas. AWS allows at most 10 managed policies attached to a user.
> >
> > **AWS IAM Policy Document** `string`
> >
> > The AWS IAM inline policy (JSON) that should be attached to the created users. Maximum 2,048 non-whitespace characters (AWS excludes whitespace from this quota).
> >
> > **Username Template** `string` (default: \{\{randomUsername}})
> >
> > Specifies a template for generating usernames. This field allows customization of how usernames are automatically created.
> >
> > Allowed template variables are:
> >
> > * `{{randomUsername}}`: Random username string.
> > * `{{unixTimestamp}}`: Current Unix timestamp at the time of lease creation.
> > * `{{identity.name}}`: Name of the identity that is generating the lease.
> > * `{{dynamicSecret.name}}`: Name of the associated dynamic secret.
> > * `{{dynamicSecret.type}}`: Type of the associated dynamic secret.
> > * `{{random N}}`: Random string of N characters.
> >
> > Allowed template functions are:
> >
> > * `truncate`: Truncates a string to a specified length.
> > * `replace`: Replaces a substring with another value.
> > * `uppercase`: Converts a string to uppercase.
> > * `lowercase`: Converts a string to lowercase.
> >
> > Examples:
> >
> > ```yaml theme={"dark"}
> > {{ randomUsername }}                                            // 3POnzeFyK9gW2nioK0q2gMjr6CZqsRiX
> > {{ unixTimestamp }}                                             // 17490641580
> > {{ identity.name }}                                             // <identity-name>
> > {{ random 5 }}                                                  // x9K2m
> > {{ truncate identity.name 4 }}                                  // test
> > {{ replace identity.name '<identity-name>' 'new-value' }}       // new-value
> > ```
> >
> > **Tags** `map[string]string`
> >
> > Tags to be added to the created IAM User resource.
>
> > [tab] Temporary Credentials
> >
> > When **Credential Type** is set to **Temporary Credentials**:
> >
> > > [!NOTE]
> > >
> > > No additional configuration parameters are required. The generated credentials will:
> > >
> > > * Inherit the permissions of your access key connection
> > > * Include an AWS Session Token
> > > * Be valid for the duration specified in Default TTL
> >
> > > [!NOTE]
> > >
> > > **Duration Limit**: Access Key temporary credentials support up to 12 hours maximum via GetSessionToken. TTL values exceeding this limit will be automatically adjusted.
> >
> > > [!NOTE]
> > >
> > > Session policies (AWS Session Policy ARNs / AWS Session Policy Document) are not supported with the Access Key method: STS GetSessionToken does not accept them. These fields are only available with the Assume Role method.
>
> **5. Click 'Submit'**
>
> After submitting the form, you will see a dynamic secret created in the dashboard.
>
> ![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret.png)
>
> **6. Generate dynamic secrets**
>
> Once you've successfully configured the dynamic secret, you're ready to generate on-demand credentials.
> To do this, simply click on the 'Generate' button which appears when hovering over the dynamic secret item.
> Alternatively, you can initiate the creation of a new lease by selecting 'New Lease' from the dynamic secret lease list section.
>
> ![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-generate.png)
>
> ![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-lease-empty.png)
>
> When generating these secrets, it's important to specify a Time-to-Live (TTL) duration. This will dictate how long the credentials are valid for.
>
> ![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/provision-lease.png)
>
> > [!TIP]
> >
> > Ensure that the TTL for the lease falls within the maximum TTL defined when configuring the dynamic secret in step 4.
>
> Once you click the `Submit` button, a new secret lease will be generated and the credentials for it will be shown to you.
>
> **Credentials format depends on your chosen credential type:**
>
> **IAM User credential type:**
>
> * AWS Username
> * AWS Access Key ID
> * AWS Secret Access Key
>
> **Temporary Credentials credential type:**
>
> * AWS Access Key ID
> * AWS Secret Access Key
> * AWS Session Token
>
>   ![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/lease-values-aws-iam.png)

## Audit or revoke leases

Once you have created one or more leases, you'll be able to access them by selecting the respective dynamic secret item on the dashboard.
This will allow you to see the lease details and delete the lease ahead of its expiration time.

![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/lease-data.png)

## Renew leases

To extend the life of the generated dynamic secret lease past its initial time to live, simply select the **Renew** button as illustrated below.

![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

> [!WARNING]
>
> Lease renewals can't exceed the maximum TTL set when configuring the dynamic
> secret


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.