Infisical
Connect Infisical with a machine identity so Safeguard can check organization members, identity token settings, secret rotation and the audit log, without reading any secret.
Connect Infisical
Safeguard reads your Infisical organization with a machine identity: who holds an organization seat, the Universal Auth token settings of your machine identities, whether secret rotation is set up, and the organization audit log. Safeguard never reads a secret value.
1. Create a machine identity in Infisical
- In your organization, open Access Control › Identities and create an identity, for example "Safeguard compliance".
- Give it an organization role that can read members, identities and audit logs and has no access to any project's secrets. A custom organization role is best. The built-in Member role with no project membership also works, but then there are no rotations to read.
- Open the identity, choose Universal Auth and create a client secret. Copy the Client ID and Client Secret.
- Copy your Organization ID from the organization settings.
Optional: secret rotation
To judge secret rotation, add the identity to each project with a custom project role that allows only Secret Rotation: Read. That role gives no access to secret values.
Plan requirement
The audit log is available on Infisical's Pro plan. On other plans, the audit-log check reports that the plan does not include audit logs; the other checks still run.
2. Connect it in Safeguard
- Open Compliance › Connectors, search for Infisical and click Connect.
- Choose API token:
| Field | What to enter |
|---|---|
| Client ID | The identity's Universal Auth client ID |
| Client secret | The client secret |
| Organization ID | Your organization's ID |
| Instance URL (optional) | Leave blank for https://app.infisical.com. Infisical EU: https://eu.infisical.com. Self-hosted: your own address. |
- Click Connect with token.
What Safeguard checks
- Organization members are linked to people in your personnel register, people who left no longer have a seat, and how many admins there are
- Members sign in with MFA or SSO. Infisical's API does not report MFA enrollment for most members, so the check names the members it could not confirm and asks you to attest for them.
- Machine identities' access tokens are short-lived
- Secret rotation is enabled
- Audit logs are available
Troubleshooting
- The audit-log check names the Pro plan: expected on plans without audit logs. Upgrade, or attest audit logging another way.
- Rotation checks have nothing to evaluate: add the identity to your projects with the Secret Rotation: Read role.