1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[4018],{37167:(e,a,o)=>{(window.__NEXT_P=window.__NEXT_P||[]).push(["/platform/pam",function(){return o(79999)}])},79999:(e,a,o)=>{"use strict";o.r(a),o.d(a,{__N_SSG:()=>n,default:()=>r});var s=o(37876),t=o(56652);let i={slug:"pam",path:"/platform/pam",accentInk:"var(--v2-product-pam-ink)",seo:{title:"Privileged Access Management | Infisical",description:"Grant just-in-time privileged access, record sessions, enforce approval workflows, and produce a complete audit trail for every elevated action from one open-source PAM platform.",ogImage:"/images/ogimage.png"},hero:{headline:"Privileged access that's fast to grant and easy to audit.",mobileHighlightTerms:["Privileged"],body:"Recorded, logged, and time-bound access to databases, servers, or cloud accounts without anyone holding credentials.",primaryCtaLabel:"Start free trial",primaryCtaLink:"https://app.infisical.com/signup",secondaryCtaLabel:"Talk to an expert",secondaryCtaLink:"/talk-to-us"},problem:{headline:"PAM wasn't built for developers.",accentText:"developers",accentPosition:"inline",body:"If an incident requires prod database access, you don't want to wait for someone to share admin credentials. A shared credential nobody's ever rotated isn't better."},valueProps:{headline:"Get access faster than writing the ticket to request it",intro:"Automate access workflows wherever you work (including in Slack) and short-lived credentials for fast access to sensitive resources.",columns:3,cards:[{kicker:"Grant",icon:"lock",title:"Tightly-scoped temporary access",body:"Connections happen through a scoped account for that specific resource, no broad access that remains after session end.",visual:"PamGrantFlowVisual"},{kicker:"Record",icon:"clipboard",title:"Every session is its own audit trail",body:"Automated session recording, with logs for SSH and databases and full video recordings on Windows RDP.",visual:"PamRecordingLogsVisual"},{kicker:"Deploy",icon:"badge",title:"A gateway, not an agent",body:"Gateway-based architecture: no agent to install on every server or database, just an outbound-only proxy, so rollout doesn't scale with your resource count.",visual:"PamGatewayTopologyVisual"}]},section4:{kicker:"How it works",headline:"From gateway to full session audit trail.",intro:"Deploy a gateway, connect your resources, grant scoped access on request, and review every session after the fact.",demoComponent:"PamIllustration",tabs:[{label:"Deploy gateway",detail:"Drop in an outbound-only gateway, with no agent to install on every resource.",media:{kind:"video",src:"/videos/pam/account-creation.webm",alt:"Deploying a PAM gateway"}},{label:"Define resources and policies",detail:"Connect databases, servers, and cloud accounts, then set time-bound access policies.",media:{kind:"video",src:"/videos/pam/account-templates-policies.webm",alt:"Defining PAM resources and access policies"}},{label:"Provision access",detail:"Grant scoped, short-lived access on request, with approval gates on sensitive accounts.",media:{kind:"video",src:"/videos/pam/provision-access.webm",alt:"Provisioning just-in-time access"}},{label:"Watch session recordings",detail:"Replay full sessions with command-level and query-level logs, captured automatically.",media:{kind:"video",src:"/videos/pam/session-recording.webm",alt:"Reviewing a recorded privileged session"}}]},checklist:{headline:"Built for how PAM should work, not how it always has.",intro:"Time-bound, self-serve access requests with approval gates on sensitive accounts and break-glass policies.",items:[{label:"Session recording",detail:"Full playback for every connection.",icon:"video"},{label:"Query- and command-level logs",detail:"Query-level logs for PostgreSQL and command-level logs for SSH, with regex-based masking.",icon:"terminal"},{label:"Enforced session controls",detail:"MFA re-authentication, required connection reasons, and command blocking enforced per account template.",icon:"shieldCheck"},{label:"Databases",detail:"PostgreSQL, MySQL, MSSQL, and MongoDB, with automated rotation on Postgres, MySQL, and MSSQL.",icon:"database"}
1,{label:"Servers",detail:"SSH and Windows (RDP), including Windows AD-joined machines.",icon:"server"},{label:"Cloud identities",detail:"AWS IAM, Azure CLI, GCP service accounts, and Kubernetes.",icon:"cloud"},{label:"Active Directory, Linux, and Unix discovery",detail:"Surfaces existing privileged accounts for review.",icon:"search"},{label:"Gateway-based architecture",detail:"Outbound-only, no inbound firewall rules, end-to-end encrypted.",icon:"antenna"},{label:"Full audit logging",detail:"Every account, folder, template, and membership change.",icon:"reports"},{label:"Role-based access control",detail:"Down to per-folder and per-account permissions.",icon:"group"},{label:"Bring your own storage",detail:"Store recordings internally or in your own S3 bucket.",icon:"storage"}]},socialProof:{headline:"Trusted for security and speed",ctaLabel:"View all customer stories",ctaHref:"/customers",testimonials:[{quote:"Infisical is much simpler, much safer. If you want to move fast and be secure at the same time, Infisical is what you want.",name:"Milos Vetesnik",role:"Co-founder",company:"Excalidraw",logo:"excalidraw",slug:"excalidraw"},{quote:"I create a new role with access to only certain variables, and that guarantees the agent only ever has access to that set of values.",name:"Soohoon Choi",role:"Founder and CTO",company:"Greptile",logo:"greptile",slug:"greptile"}]},faq:[{q:"Does this replace standing admin accounts entirely?",a:"For newly onboarded resources, yes. Access is scoped and time-bound by default. You can migrate existing standing access over time."},{q:"What happens to a session after it ends?",a:"It's fully recorded, with playback and logs, so access is auditable after the fact without slowing anyone down beforehand."},{q:"What resources does it support today?",a:"Infisical PAM currently supports PostgreSQL, MySQL, MSSQL, MongoDB, SSH, Windows, AWS IAM, Azure CLI, GCP service accounts, and Kubernetes, with more added regularly."},{q:"Self-hosted or cloud?",a:"You can self-host Infisical PAM on any infrastructure or use our cloud version on the US or EU clusters."}],finalCta:{headline:"Privileged access that auditors will thank you for.",primaryLabel:"Start free trial",primaryHref:"https://app.infisical.com/signup",secondaryLabel:"Talk to an expert",secondaryHref:"/talk-to-us",steps:[{label:"Connect your IdP",detail:"Wire up your existing SSO or OIDC provider in minutes."}
1,{label:"Register resources",detail:"Define the servers and databases to gate behind JIT approval."},{label:"Go live",detail:"Issue your first time-bound credential and remove standing access."}]}};var n=!0;function r(e){let{marqueeLogos:a}=e;return(0,s.jsx)(t.A,{product:i,marqueeLogos:a})}}},e=>{e.O(0,[5587,8194,4899,5466,3534,6937,2535,8707,4876,1242,6652,636,6593,8792],()=>e(e.s=37167)),_N_E=e.O()}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.