Generating Ephemeral PostgreSQL Credentials
PostgreSQL ephemeral credentials create a unique short-lived login role in the target database. The configured privileges are granted for the selected duration and the role is dropped after expiration.
1. Configure a PostgreSQL super account that can create roles, grant and revoke the required privileges, and drop roles.
2. Enable privileged operations in the PostgreSQL Vault configuration and define the Super Username and required password, or select a vault-managed super account.
3. Open the connector's Just In Time properties.
4. In Command set for JIT Creation, create a login role with the generated name and password, set its expiration time, and grant only the required database privileges.
5. In Command set for JIT Revocation, revoke the granted privileges and drop the generated role.
6. Use the supported runtime placeholders for the generated name, password, and expiration time.
A PostgreSQL role name must start with a letter or underscore unless it is quoted. Use a Base account name that allows Kron PAM to generate a compatible alphanumeric role name.
To generate and verify the credentials:
1. Create or edit a Static account with Account Subtype set to Ephemeral Base and select the PostgreSQL configuration.
2. Open the Base account action menu and select Generate Ephemeral Account.
3. Select the required Duration, enter a Comment, and generate the credential.
4. Verify that the Vault lists a unique Dynamic PostgreSQL account and a next lifecycle time based on the selected duration.
5. Use the generated credential during the validity period, then verify that the PostgreSQL role is dropped after expiration.
