> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS MemoryDB dynamic secrets

> Learn how to dynamically generate AWS MemoryDB (Valkey/Redis) user credentials.

The Infisical AWS MemoryDB dynamic secret generates short-lived MemoryDB users (Valkey or Redis OSS engine) and attaches them to the ACL already associated with your target cluster. Each lease creates a new MemoryDB user with a fresh password; revocation deletes the user.

## Prerequisites

1. A MemoryDB cluster with an ACL attached. If your cluster is still on the default `open-access` ACL, attach a real ACL before configuring the dynamic secret — Infisical will refuse to add users to a cluster with no ACL.
2. An AWS IAM user for Infisical to use, with an access key ID and secret access key. Attach the following policy:

```json theme={"dark"}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "memorydb:DescribeClusters",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "memorydb:CreateUser",
        "memorydb:DeleteUser",
        "memorydb:UpdateACL"
      ],
      "Resource": "arn:aws:memorydb:*:*:user/inf-*"
    },
    {
      "Effect": "Allow",
      "Action": "memorydb:UpdateACL",
      "Resource": "arn:aws:memorydb:*:*:acl/*"
    }
  ]
}
```

A few notes on the policy:

* `memorydb:DescribeClusters` doesn't support resource-level scoping, so it must be `"Resource": "*"`.
* The `user/inf-*` pattern matches the `inf-` username prefix Infisical applies to every generated user.
* `memorydb:UpdateACL` is granted on both the user ARN and the ACL ARN because AWS evaluates the action against every resource it touches in a single call (the ACL plus each user being added or removed).
* If you'd like to pin the ACL more tightly, replace `acl/*` with `acl/<your-acl-name>`.

> [!NOTE]
>
> New leases may take a short while to become usable while MemoryDB propagates the user across the cluster's shards. We recommend a retry strategy when first connecting with newly-issued credentials.

## Set up dynamic secrets with AWS MemoryDB

**1. Open Secret Overview Dashboard**

Open the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret.

**2. Click on the 'Add Dynamic Secret' button**

![Add Dynamic Secret Button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/add-dynamic-secret-button.png)

**3. Select AWS MemoryDB**

![Dynamic Secret Modal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/aws-memorydb/dynamic-secret-modal-aws-memorydb.png)

**4. Provide the inputs for dynamic secret parameters**

![AWS MemoryDB Input Form](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/aws-memorydb/dynamic-secret-input-aws-memorydb.png)

**Secret Name** `string` *required*

Name by which you want the secret to be referenced.

**Default TTL** `string` *required*

Default time-to-live for a generated secret (this can be changed after the secret is created).

**Max TTL** `string` *required*

Maximum time-to-live for a generated secret.

**Cluster name** `string` *required*

The name of the MemoryDB cluster Infisical should provision users for.

**Region** `string` *required*

The AWS region the MemoryDB cluster lives in (e.g. `us-east-1`).

**Access Key ID** `string` *required*

Access key ID of the AWS IAM user from the prerequisites.

**Secret Access Key** `string` *required*

Secret access key of the AWS IAM user from the prerequisites.

**5. (Optional) Modify MemoryDB Statements**

![Modify MemoryDB Statements](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/aws-memorydb/modify-memorydb-statement.png)

**Username Template** `string` (default: \{\{randomUsername}})

Specifies a template for generating usernames. This field allows customization of how usernames are automatically created.

Allowed template variables are:

* `{{randomUsername}}`: Random username string.
* `{{unixTimestamp}}`: Current Unix timestamp at the time of lease creation.
* `{{identity.name}}`: Name of the identity that is generating the lease.
* `{{dynamicSecret.name}}`: Name of the associated dynamic secret.
* `{{dynamicSecret.type}}`: Type of the associated dynamic secret.
* `{{random N}}`: Random string of N characters.

Allowed template functions are:

* `truncate`: Truncates a string to a specified length.
* `replace`: Replaces a substring with another value.
* `uppercase`: Converts a string to uppercase.
* `lowercase`: Converts a string to lowercase.

Examples:

```yaml theme={"dark"}
{{ randomUsername }}                                            // 3POnzeFyK9gW2nioK0q2gMjr6CZqsRiX
{{ unixTimestamp }}                                             // 17490641580
{{ identity.name }}                                             // <identity-name>
{{ random 5 }}                                                  // x9K2m
{{ truncate identity.name 4 }}                                  // test
{{ replace identity.name '<identity-name>' 'new-value' }}       // new-value
```

**Creation Statement** `string`

A JSON payload passed to MemoryDB's `CreateUser` API. `{{username}}` and `{{password}}` are substituted with Infisical-generated values at lease time. Use the `AccessString` field to scope each lease's permissions.

Default:

```json theme={"dark"}
{
  "UserName": "{{username}}",
  "AccessString": "on ~* +@all",
  "AuthenticationMode": { "Type": "password", "Passwords": ["{{password}}"] }
}
```

**Revocation Statement** `string`

A JSON payload passed to MemoryDB's `DeleteUser` API. `{{username}}` is substituted at revoke time.

Default:

```json theme={"dark"}
{ "UserName": "{{username}}" }
```

**6. Click `Submit`**

Infisical will verify it can reach the cluster with the provided credentials and validate the statements.

**7. Generate dynamic secrets**

Once configured, select `Generate` on the dynamic secret row (or `New Lease` in the lease list) to provision a lease.

![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-generate.png)

![Dynamic Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-lease-empty.png)

Specify a TTL within the configured Max TTL.

![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/provision-lease.png)

The generated username and password are shown once on lease creation.

![Provision Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/lease-values.png)

## Audit or revoke leases

Select any dynamic secret on the dashboard to see active leases, their expiration times, and revoke them early if needed.

![Lease Data](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/lease-data.png)

## Renew leases

Select `Renew` on an active lease to extend its TTL.

![Renew Lease](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/dynamic-secrets/dynamic-secret-lease-renew.png)

> [!WARNING]
>
> Renewals can't exceed the Max TTL set when the dynamic secret was configured.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.