pam access - Infisical

infisical pam access <path> [flags]

Description

Open one PAM-managed account for your own use, brokered through Infisical’s Gateway so you never handle its credentials. Requires infisical login. This single command handles every account type: the CLI adapts its behavior to whichever type the account’s template defines (see Account Types and Behavior below).

To open several accounts at once for an AI agent, use infisical pam agentic access instead, which can also authenticate as a machine identity so an agent can run unattended.

Arguments

Argument	Description
`<path>`	Required. Path to the PAM account in format `folder/account-name`

Flags

--duration

Session duration. Supports Go duration format (e.g., 1h, 30m, 2h30m).Default value: 1h

# Example
infisical pam access production/postgres-main --duration 4h

--reason

Audit reason for access. Required by some policies; prompts interactively if TTY available.

# Example
infisical pam access production/database --reason "Investigating incident INC-1234"

--port

Local proxy port. Use 0 for auto-assign.Default value: 0

# Example
infisical pam access staging/mysql-replica --port 3306

--target

Target host for multi-host accounts (e.g., Windows AD environments).

# Example
infisical pam access windows/domain-admin --target dc01.corp.local

--domain

Domain of your self-hosted Infisical instance. If not specified, defaults to Infisical Cloud.

# Example
infisical pam access production/database --domain https://your-infisical-instance.com

Account Types and Behavior

Based on the account’s template, the CLI starts the appropriate local proxy or credential helper.

Databases (PostgreSQL, MySQL, SQL Server, MongoDB)

Starts a local database proxy on 127.0.0.1. Connect using standard database clients — no password required as authentication is handled by the proxy.

# Example
infisical pam access production/postgres-main --duration 2h

The output includes connection details and CLI examples:

Database Type	Connection String Format
PostgreSQL	`postgres://<username>@127.0.0.1:<port>/<database>`
MySQL	`mysql://<username>@127.0.0.1:<port>/<database>`
SQL Server	`sqlserver://<username>@127.0.0.1:<port>?database=<database>`
MongoDB	`mongodb://127.0.0.1:<port>/<database>`

Redis

Starts a local Redis proxy on 127.0.0.1. Connect using any Redis client with no password, as authentication is handled by the proxy.

# Example
infisical pam access production/cache-primary --duration 2h

Then connect with redis-cli or any Redis client:

redis-cli -h 127.0.0.1 -p <port>

Connection string format: redis://127.0.0.1:<port>

SSH

Starts a local SSH proxy. Use standard SSH/SCP/SFTP/rsync commands to connect.

# Start the proxy
infisical pam access servers/prod-bastion

Then connect using your SSH client:

# SSH
ssh -p <port> -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null user@127.0.0.1

# SCP file transfer
scp -P <port> -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null file.txt user@127.0.0.1:/path/

# rsync
rsync -e "ssh -p <port> -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" local-dir/ user@127.0.0.1:/remote/path/

Kubernetes

Starts a local Kubernetes proxy and automatically configures kubectl context.

# Example
infisical pam access clusters/prod-cluster --duration 4h

kubectl is automatically configured with a context named infisical-k8s-pam/folder/account-name. Use kubectl normally:

kubectl get pods
kubectl get namespaces

The original kubeconfig context is restored when the session ends.

AWS IAM

Writes temporary STS credentials to your AWS credentials file (~/.aws/credentials or wherever AWS_SHARED_CREDENTIALS_FILE points).

# Example
infisical pam access aws/production-role

The credentials are written as a named profile: infisical-pam/folder/account-nameUse with the AWS CLI:

# Use --profile flag
aws s3 ls --profile "infisical-pam/aws/production-role"

# Or export the profile
export AWS_PROFILE="infisical-pam/aws/production-role"
aws s3 ls

The session blocks until Ctrl+C or credential expiry. When the session ends, the profile is removed from the credentials file.

GCP Service Account

Starts a local proxy on 127.0.0.1 and automatically configures gcloud to route through it (via the proxy/*, auth/access_token_file, and core/custom_ca_certs_file config properties). Requires the gcloud CLI to be installed. All traffic is proxied through the Infisical Gateway, which injects the brokered credentials before forwarding to googleapis.com.

# Example
infisical pam access gcp/prod-deployer

Run gcloud and other Google Cloud tooling as normal — no per-command configuration needed:

gcloud compute instances list
gcloud storage ls

The session blocks until Ctrl+C or expiry. On shutdown, your gcloud configuration is restored.

Azure CLI

Starts an isolated, authenticated az shell for the session (using a temporary AZURE_CONFIG_DIR, so your own az login is untouched). Requires the Azure CLI (az) to be installed. All traffic is proxied through the Infisical Gateway, which injects the brokered token before forwarding to management.azure.com.

# Example
infisical pam access azure/prod-reader

Run az as normal inside the session shell:

az account show
az group list

Type exit to end the session (or press Ctrl+C, or wait for expiry). The isolated session state is wiped on shutdown.

Windows / RDP

Starts a local RDP proxy. Connect your RDP client to 127.0.0.1 on the assigned port.

# Single-server Windows account
infisical pam access windows/admin-server

# Windows AD with multiple targets
infisical pam access windows/domain-admin --target dc01.corp.local

Connect using your preferred RDP client (e.g., Microsoft Remote Desktop, xfreerdp, Remmina).

MFA Support

If your organization requires MFA for PAM access:

CLI detects SESSION_MFA_REQUIRED response
Browser opens to MFA verification page
CLI polls for up to 5 minutes for completion
Access continues automatically after MFA verification

This is the only command that can satisfy an MFA requirement. pam agentic access does not support MFA-gated accounts yet, so reach those here.

Reason Prompting

Some PAM policies require an audit reason. Behavior:

Scenario	Behavior
With `--reason` flag	Uses provided reason
Interactive terminal (TTY)	Prompts for reason if required
Non-interactive (CI/CD)	Fails with error if reason required but not provided

# Provide reason via flag
infisical pam access production/database --reason "Investigating incident INC-1234"

Error Messages

Error	Cause	Solution
`Invalid duration format`	Malformed `--duration` value	Use formats like `1h`, `30m`, `2h30m`
`a reason is required to access this account`	Policy requires reason, no TTY	Pass `--reason` flag
`Gateway does not support '{type}' PAM accounts`	Gateway version too old	Upgrade Infisical Gateway
`PAM response metadata is missing`	API response incomplete	Contact support

​Description

​Arguments

​Flags

​Account Types and Behavior

​MFA Support

​Reason Prompting

​Error Messages

Description

Arguments

Flags

Account Types and Behavior

MFA Support

Reason Prompting

Error Messages