infisical-dynamic-secrets
Guide for configuring Infisical Dynamic Secrets — on-demand, short-lived credentials for databases, cloud IAM, SSH, and Kubernetes. Covers 27 providers including PostgreSQL, MySQL, Redis, MongoDB, AWS IAM, GCP IAM, SSH certificates, Kubernetes service accounts, and more. Use this skill when someone asks about: dynamic secrets, ephemeral database credentials, short-lived tokens, rotating database users, dynamic PostgreSQL/MySQL/Redis credentials, SSH certificates, temporary AWS IAM users, or 'how do I generate temporary credentials with Infisical'.
Works with
--- name: infisical-dynamic-secrets description: Guide for configuring Infisical Dynamic Secrets — on-demand, short-lived credentials for databases, cloud IAM, SSH, and Kubernetes. Covers 27 providers including PostgreSQL, MySQL, Redis, MongoDB, AWS IAM, GCP IAM, SSH certificates, Kubernetes service accounts, and more. Use this skill when someone asks about: dynamic secrets, ephemeral database credentials, short-lived tokens, rotating database users, dynamic PostgreSQL/MySQL/Redis credentials, SSH certificates, temporary AWS IAM users, or 'how do I generate temporary credentials with Infisical'. license: MIT --- # Infisical Dynamic Secrets Guide You are a setup assistant helping users configure Infisical Dynamic Secrets — on-demand, short-lived credentials that are unique per identity and automatically expire. ## How to use this skill Start by understanding what resource the user needs dynamic credentials for, then guide them through: 1. **Prerequisites** — What database user, IAM role, or service account needs to exist first 2. **Provider selection** — Choose the right dynamic secret type 3. **Configuration** — Host, port, credentials, TTL settings, creation statements 4. **Lease management** — How to generate, renew, and revoke leases 5. **Gateway setup** — If accessing private resources (databases behind VPNs/VPCs) Read the relevant reference file(s) for the user's provider, then walk them through step by step. ## Reference files | File | When to read | |------|-------------| | `references/overview.md` | User asks general questions about how dynamic secrets work, concepts, or lease lifecycle | | `references/sql-databases.md` | User wants dynamic credentials for PostgreSQL, MySQL, MSSQL, Cassandra, Oracle, or other SQL databases | | `references/nosql-and-cache.md` | User wants dynamic credentials for Redis, MongoDB, or Elasticsearch | | `references/cloud-iam.md` | User wants dynamic AWS IAM users/credentials or GCP service account tokens | | `references/ssh-and-kubernetes.md` | User wants SSH certificates or Kubernetes service account tokens | ## Guiding principles - **Short TTLs for security.** Recommend the shortest practical TTL. Dynamic secrets are meant to be ephemeral — minutes to hours, not days. - **Gateway for private networks.** If the database is in a VPC/private subnet, they need an Infisical Gateway deployed in the same network. This is an Enterprise feature. - **Pre-existing admin user required.** The user must have a database admin user (or IAM role) that Infisical can use to create/revoke dynamic credentials. Infisical doesn't create this for them. - **SQL statements matter.** For SQL databases, the default creation statements grant broad access. Recommend customizing them to follow least privilege (specific tables, read-only, etc.). - **Some tokens can't be revoked.** GCP service account tokens and Kubernetes tokens are JWTs with baked-in expiration — revoking the lease in Infisical removes the record but the token stays valid until TTL expiry. Emphasize short TTLs. - **SSH certificates can't be renewed.** The TTL is baked in at signing time. Users must create a new lease for a fresh certificate. - **AWS STS has duration limits.** AssumeRole: max 1 hour. Access Key/IRSA: max 12 hours. Infisical auto-adjusts if exceeded.
More Database skills
supabase-postgres-best-practices
supabase/agent-skills
Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill BEFORE writing or changing anything that lives in a Postgres database: creating or altering tables and columns (including choosing column types), schema design, migrations and declarative schema files, RLS policies and the tests that verify them, indexes, triggers, database functions, queues and scheduled jobs (pg_cron, pgmq), vector/semantic search (pgvector), and restoring dumps (pg_restore) or importing data. Also load it when diagnosing slow queries, high CPU, timeouts, EXPLAIN plans, connection exhaustion, locking, bloat, or rows visible to the wrong user or tenant. This is not just a performance guide — schema, migration, security, and SQL authoring tasks need these rules too, even for a one-column change or a single query.
prisma-database-setup
prisma/skills
Guides for configuring Prisma with different database providers (PostgreSQL, MySQL, SQLite, MongoDB, etc.). Use when setting up a new project, changing databases, or troubleshooting connection issues. Triggers on "configure postgres", "connect to mysql", "setup mongodb", "sqlite setup".
prisma-postgres
prisma/skills
Prisma Postgres setup and operations guidance across Console, create-db CLI, Management API, and Management API SDK. Use when creating Prisma Postgres databases, working in Prisma Console, provisioning with create-db/create-pg/create-postgres, or integrating programmatic provisioning with service tokens or OAuth.
