AWS MemoryDB

Learn how to dynamically generate AWS MemoryDB (Valkey/Redis) user credentials.

The Infisical AWS MemoryDB dynamic secret generates short-lived MemoryDB users (Valkey or Redis OSS engine) and attaches them to the ACL already associated with your target cluster. Each lease creates a new MemoryDB user with a fresh password; revocation deletes the user.

Prerequisites

1. A MemoryDB cluster with an ACL attached. If your cluster is still on the default open-access ACL, attach a real ACL before configuring the dynamic secret — Infisical will refuse to add users to a cluster with no ACL.
2. An AWS IAM user for Infisical to use, with an access key ID and secret access key. Attach the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "memorydb:DescribeClusters",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "memorydb:CreateUser",
        "memorydb:DeleteUser",
        "memorydb:UpdateACL"
      ],
      "Resource": "arn:aws:memorydb:*:*:user/inf-*"
    },
    {
      "Effect": "Allow",
      "Action": "memorydb:UpdateACL",
      "Resource": "arn:aws:memorydb:*:*:acl/*"
    }
  ]
}

A few notes on the policy:

• memorydb:DescribeClusters doesn’t support resource-level scoping, so it must be "Resource": "*".
• The user/inf-* pattern matches the inf- username prefix Infisical applies to every generated user.
• memorydb:UpdateACL is granted on both the user ARN and the ACL ARN because AWS evaluates the action against every resource it touches in a single call (the ACL plus each user being added or removed).
• If you’d like to pin the ACL more tightly, replace acl/* with acl/<your-acl-name>.

New leases may take a short while to become usable while MemoryDB propagates the user across the cluster’s shards. We recommend a retry strategy when first connecting with newly-issued credentials.

Set up Dynamic Secrets with AWS MemoryDB

1. Open Secret Overview Dashboard

   Open the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret.

2. Click on the 'Add Dynamic Secret' button

   
3. Select AWS MemoryDB

   
4. Provide the inputs for dynamic secret parameters

   

   Secret Name · string · required

   Name by which you want the secret to be referenced.

   Default TTL · string · required

   Default time-to-live for a generated secret (this can be changed after the secret is created).

   Max TTL · string · required

   Maximum time-to-live for a generated secret.

   Cluster name · string · required

   The name of the MemoryDB cluster Infisical should provision users for.

   Region · string · required

   The AWS region the MemoryDB cluster lives in (e.g. us-east-1).

   Access Key ID · string · required

   Access key ID of the AWS IAM user from the prerequisites.

   Secret Access Key · string · required

   Secret access key of the AWS IAM user from the prerequisites.

5. (Optional) Modify MemoryDB Statements

   

   Username Template · string · default: "{{randomUsername}}"

   Specifies a template for generating usernames. This field allows customization of how usernames are automatically created.

   Allowed template variables are:

   • {{randomUsername}}: Random username string.
   • {{unixTimestamp}}: Current Unix timestamp at the time of lease creation.
   • {{identity.name}}: Name of the identity that is generating the lease.
   • {{dynamicSecret.name}}: Name of the associated dynamic secret.
   • {{dynamicSecret.type}}: Type of the associated dynamic secret.
   • {{random N}}: Random string of N characters.

   Allowed template functions are:

   • truncate: Truncates a string to a specified length.
   • replace: Replaces a substring with another value.
   • uppercase: Converts a string to uppercase.
   • lowercase: Converts a string to lowercase.

   Examples:

   {{ randomUsername }}                                            // 3POnzeFyK9gW2nioK0q2gMjr6CZqsRiX
   {{ unixTimestamp }}                                             // 17490641580
   {{ identity.name }}                                             // <identity-name>
   {{ random 5 }}                                                  // x9K2m
   {{ truncate identity.name 4 }}                                  // test
   {{ replace identity.name '<identity-name>' 'new-value' }}       // new-value
   

   Creation Statement · string

   A JSON payload passed to MemoryDB’s CreateUser API. {{username}} and {{password}} are substituted with Infisical-generated values at lease time. Use the AccessString field to scope each lease’s permissions.

   Default:

   {
     "UserName": "{{username}}",
     "AccessString": "on ~* +@all",
     "AuthenticationMode": { "Type": "password", "Passwords": ["{{password}}"] }
   }
   

   Revocation Statement · string

   A JSON payload passed to MemoryDB’s DeleteUser API. {{username}} is substituted at revoke time.

   Default:

   { "UserName": "{{username}}" }
   
6. Click `Submit`

   Infisical will verify it can reach the cluster with the provided credentials and validate the statements.

7. Generate dynamic secrets

   Once configured, click Generate on the dynamic secret row (or New Lease in the lease list) to provision a lease.

   

   Specify a TTL within the configured Max TTL.

   

   The generated username and password are shown once on lease creation.

   

Audit or Revoke Leases

Click any dynamic secret on the dashboard to see active leases, their expiration times, and revoke them early if needed.

Renew Leases

Click Renew on an active lease to extend its TTL.

Renewals cannot exceed the Max TTL set when the dynamic secret was configured.