Generating Ephemeral Accounts
Kron PAM can create short-lived accounts for Classic Active Directory, Microsoft Entra ID, PostgreSQL, and AWS Console access. Each account is generated from a reusable Ephemeral Base account, remains valid for the selected duration, and is removed from the target system when that duration expires.
An Ephemeral Base account is a Static template, not the temporary account. Each Generate Ephemeral Account operation creates a separate Dynamic account with a unique suffix.
Common Account Model
The same account model applies to all four target systems. The Base account stores the target connection and connector configuration. The generated account contains the temporary username and password and inherits the Base account's permissions and notification settings.
1. Create or edit the reusable template under Secrets > Vault.
2. Select Static in Type and Ephemeral Base in Account Subtype.
3. Select the connector Configuration, Account Group, Account Name, and target Host (IP/Name).
4. Open the Base account action menu and select Generate Ephemeral Account under Password.
5. Select a Duration, enter the required Comment, and generate the account.
6. Use the generated account only during the selected validity period.
Naming and Expiration
Kron PAM derives the generated account name from the Base account name and appends a random alphanumeric suffix. Keep Base names short enough for the target system's username limits. The generated account is recorded as Dynamic and its next lifecycle time is calculated from the selected duration.
At expiration, Kron PAM does not rotate the temporary password. It revokes the granted access and deletes the generated account or role from the target system. The Ephemeral Base account remains available for reuse.