---
title: Generating Ephemeral Accounts
slug: kronpam-reference-guide-3-9-0/generating-ephemeral-accounts
docTags: 
createdAt: 2026-10-10T13:41:22.102Z
---

Kron PAM can create short-lived accounts for Classic Active Directory, Microsoft Entra ID, PostgreSQL, and AWS Console access. Each account is generated from a reusable Ephemeral Base account, remains valid for the selected duration, and is removed from the target system when that duration expires.

:::hint{type="info"}
An Ephemeral Base account is a **Static** template, not the temporary account. Each **Generate Ephemeral Account** operation creates a separate **Dynamic** account with a unique suffix.
:::

### Common Account Model

The same account model applies to all four target systems. The Base account stores the target connection and connector configuration. The generated account contains the temporary username and password and inherits the Base account's permissions and notification settings.



1.      Create or edit the reusable template under **Secrets** > **Vault**.

2.      Select **Static** in **Type** and **Ephemeral Base** in **Account Subtype**.

3.      Select the connector **Configuration**, **Account Group**, **Account Name**, and target **Host (IP/Name)**.

4.      Open the Base account action menu and select **Generate Ephemeral Account** under **Password**.

5.      Select a **Duration**, enter the required **Comment**, and generate the account.

6.      Use the generated account only during the selected validity period.

### Naming and Expiration

Kron PAM derives the generated account name from the Base account name and appends a random alphanumeric suffix. Keep Base names short enough for the target system's username limits. The generated account is recorded as **Dynamic** and its next lifecycle time is calculated from the selected duration.

:::hint{type="info"}
At expiration, Kron PAM does not rotate the temporary password. It revokes the granted access and deletes the generated account or role from the target system. The Ephemeral Base account remains available for reuse.
:::