Merge branch 'main' into PLATFRM-114

backend/src/db/migrations/20251203224427_pam-aws-console.ts

@@ -0,0 +1,21 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasGatewayId = await knex.schema.hasColumn(TableName.PamResource, "gatewayId");
+  if (hasGatewayId) {
+    await knex.schema.alterTable(TableName.PamResource, (t) => {
+      t.uuid("gatewayId").nullable().alter();
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasGatewayId = await knex.schema.hasColumn(TableName.PamResource, "gatewayId");
+  if (hasGatewayId) {
+    await knex.schema.alterTable(TableName.PamResource, (t) => {
+      t.uuid("gatewayId").notNullable().alter();
+    });
+  }
+}

backend/src/db/schemas/pam-resources.ts

@@ -13,7 +13,7 @@ export const PamResourcesSchema = z.object({
   id: z.string().uuid(),
   projectId: z.string(),
   name: z.string(),
-  gatewayId: z.string().uuid(),
+  gatewayId: z.string().uuid().nullable().optional(),
   resourceType: z.string(),
   encryptedConnectionDetails: zodBuffer,
   createdAt: z.date(),

backend/src/ee/routes/v1/pam-account-routers/index.ts

@@ -1,3 +1,8 @@
+import {
+  CreateAwsIamAccountSchema,
+  SanitizedAwsIamAccountWithResourceSchema,
+  UpdateAwsIamAccountSchema
+} from "@app/ee/services/pam-resource/aws-iam/aws-iam-resource-schemas";
 import {
   CreateMySQLAccountSchema,
   SanitizedMySQLAccountWithResourceSchema,
@@ -44,5 +49,14 @@ export const PAM_ACCOUNT_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fasti
       createAccountSchema: CreateSSHAccountSchema,
       updateAccountSchema: UpdateSSHAccountSchema
     });
+  },
+  [PamResource.AwsIam]: async (server: FastifyZodProvider) => {
+    registerPamResourceEndpoints({
+      server,
+      resourceType: PamResource.AwsIam,
+      accountResponseSchema: SanitizedAwsIamAccountWithResourceSchema,
+      createAccountSchema: CreateAwsIamAccountSchema,
+      updateAccountSchema: UpdateAwsIamAccountSchema
+    });
   }
 };

backend/src/ee/routes/v1/pam-account-routers/pam-account-endpoints.ts

@@ -22,7 +22,7 @@ export const registerPamResourceEndpoints = <C extends TPamAccount>({
     folderId?: C["folderId"];
     name: C["name"];
     description?: C["description"];
-    rotationEnabled: C["rotationEnabled"];
+    rotationEnabled?: C["rotationEnabled"];
     rotationIntervalSeconds?: C["rotationIntervalSeconds"];
   }>;
   updateAccountSchema: z.ZodType<{
@@ -65,7 +65,7 @@ export const registerPamResourceEndpoints = <C extends TPamAccount>({
             folderId: req.body.folderId,
             name: req.body.name,
             description: req.body.description,
-            rotationEnabled: req.body.rotationEnabled,
+            rotationEnabled: req.body.rotationEnabled ?? false,
             rotationIntervalSeconds: req.body.rotationIntervalSeconds
           }
         }

backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts

@@ -3,8 +3,10 @@ import { z } from "zod";
 import { PamFoldersSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { PamAccountOrderBy, PamAccountView } from "@app/ee/services/pam-account/pam-account-enums";
+import { SanitizedAwsIamAccountWithResourceSchema } from "@app/ee/services/pam-resource/aws-iam/aws-iam-resource-schemas";
 import { SanitizedMySQLAccountWithResourceSchema } from "@app/ee/services/pam-resource/mysql/mysql-resource-schemas";
 import { PamResource } from "@app/ee/services/pam-resource/pam-resource-enums";
+import { GatewayAccessResponseSchema } from "@app/ee/services/pam-resource/pam-resource-schemas";
 import { SanitizedPostgresAccountWithResourceSchema } from "@app/ee/services/pam-resource/postgres/postgres-resource-schemas";
 import { SanitizedSSHAccountWithResourceSchema } from "@app/ee/services/pam-resource/ssh/ssh-resource-schemas";
 import { BadRequestError } from "@app/lib/errors";
@@ -18,9 +20,12 @@ import { AuthMode } from "@app/services/auth/auth-type";
 const SanitizedAccountSchema = z.union([
   SanitizedSSHAccountWithResourceSchema, // ORDER MATTERS
   SanitizedPostgresAccountWithResourceSchema,
-  SanitizedMySQLAccountWithResourceSchema
+  SanitizedMySQLAccountWithResourceSchema,
+  SanitizedAwsIamAccountWithResourceSchema
 ]);
 
+type TSanitizedAccount = z.infer<typeof SanitizedAccountSchema>;
+
 export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "GET",
@@ -93,7 +98,7 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
         }
       });
 
-      return { accounts, folders, totalCount, folderId, folderPaths };
+      return { accounts: accounts as TSanitizedAccount[], folders, totalCount, folderId, folderPaths };
     }
   });
 
@@ -125,18 +130,19 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
           })
       }),
       response: {
-        200: z.object({
-          sessionId: z.string(),
-          resourceType: z.nativeEnum(PamResource),
-          relayClientCertificate: z.string(),
-          relayClientPrivateKey: z.string(),
-          relayServerCertificateChain: z.string(),
-          gatewayClientCertificate: z.string(),
-          gatewayClientPrivateKey: z.string(),
-          gatewayServerCertificateChain: z.string(),
-          relayHost: z.string(),
-          metadata: z.record(z.string(), z.string().optional()).optional()
-        })
+        200: z.discriminatedUnion("resourceType", [
+          // Gateway-based resources (Postgres, MySQL, SSH)
+          GatewayAccessResponseSchema.extend({ resourceType: z.literal(PamResource.Postgres) }),
+          GatewayAccessResponseSchema.extend({ resourceType: z.literal(PamResource.MySQL) }),
+          GatewayAccessResponseSchema.extend({ resourceType: z.literal(PamResource.SSH) }),
+          // AWS IAM (no gateway, returns console URL)
+          z.object({
+            sessionId: z.string(),
+            resourceType: z.literal(PamResource.AwsIam),
+            consoleUrl: z.string().url(),
+            metadata: z.record(z.string(), z.string().optional()).optional()
+          })
+        ])
       }
     },
     onRequest: verifyAuth([AuthMode.JWT]),
@@ -162,7 +168,7 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
         orgId: req.permission.orgId,
-        projectId: response.projectId,
+        projectId: req.body.projectId,
         event: {
           type: EventType.PAM_ACCOUNT_ACCESS,
           metadata: {

backend/src/ee/routes/v1/pam-resource-routers/index.ts

@@ -1,3 +1,8 @@
+import {
+  CreateAwsIamResourceSchema,
+  SanitizedAwsIamResourceSchema,
+  UpdateAwsIamResourceSchema
+} from "@app/ee/services/pam-resource/aws-iam/aws-iam-resource-schemas";
 import {
   CreateMySQLResourceSchema,
   MySQLResourceSchema,
@@ -44,5 +49,14 @@ export const PAM_RESOURCE_REGISTER_ROUTER_MAP: Record<PamResource, (server: Fast
       createResourceSchema: CreateSSHResourceSchema,
       updateResourceSchema: UpdateSSHResourceSchema
     });
+  },
+  [PamResource.AwsIam]: async (server: FastifyZodProvider) => {
+    registerPamResourceEndpoints({
+      server,
+      resourceType: PamResource.AwsIam,
+      resourceResponseSchema: SanitizedAwsIamResourceSchema,
+      createResourceSchema: CreateAwsIamResourceSchema,
+      updateResourceSchema: UpdateAwsIamResourceSchema
+    });
   }
 };

backend/src/ee/routes/v1/pam-resource-routers/pam-resource-endpoints.ts

@@ -19,7 +19,7 @@ export const registerPamResourceEndpoints = <T extends TPamResource>({
   createResourceSchema: z.ZodType<{
     projectId: T["projectId"];
     connectionDetails: T["connectionDetails"];
-    gatewayId: T["gatewayId"];
+    gatewayId?: T["gatewayId"];
     name: T["name"];
     rotationAccountCredentials?: T["rotationAccountCredentials"];
   }>;
@@ -103,7 +103,7 @@ export const registerPamResourceEndpoints = <T extends TPamResource>({
           type: EventType.PAM_RESOURCE_CREATE,
           metadata: {
             resourceType,
-            gatewayId: req.body.gatewayId,
+            ...(req.body.gatewayId && { gatewayId: req.body.gatewayId }),
             name: req.body.name
           }
         }
@@ -150,8 +150,8 @@ export const registerPamResourceEndpoints = <T extends TPamResource>({
           metadata: {
             resourceId: req.params.resourceId,
             resourceType,
-            gatewayId: req.body.gatewayId,
-            name: req.body.name
+            ...(req.body.gatewayId && { gatewayId: req.body.gatewayId }),
+            ...(req.body.name && { name: req.body.name })
           }
         }
       });

backend/src/ee/routes/v1/pam-resource-routers/pam-resource-router.ts

@@ -1,6 +1,10 @@
 import { z } from "zod";
 
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import {
+  AwsIamResourceListItemSchema,
+  SanitizedAwsIamResourceSchema
+} from "@app/ee/services/pam-resource/aws-iam/aws-iam-resource-schemas";
 import {
   MySQLResourceListItemSchema,
   SanitizedMySQLResourceSchema
@@ -22,13 +26,15 @@ import { AuthMode } from "@app/services/auth/auth-type";
 const SanitizedResourceSchema = z.union([
   SanitizedPostgresResourceSchema,
   SanitizedMySQLResourceSchema,
-  SanitizedSSHResourceSchema
+  SanitizedSSHResourceSchema,
+  SanitizedAwsIamResourceSchema
 ]);
 
 const ResourceOptionsSchema = z.discriminatedUnion("resource", [
   PostgresResourceListItemSchema,
   MySQLResourceListItemSchema,
-  SSHResourceListItemSchema
+  SSHResourceListItemSchema,
+  AwsIamResourceListItemSchema
 ]);
 
 export const registerPamResourceRouter = async (server: FastifyZodProvider) => {

backend/src/ee/routes/v2/identity-project-additional-privilege-router.ts

@@ -84,7 +84,6 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         privilege: {
           ...privilege,
           identityId: req.body.identityId,
-          projectMembershipId: req.body.projectId,
           projectId: req.body.projectId,
           slug: privilege.name
         }
@@ -168,7 +167,6 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         privilege: {
           ...privilege,
           identityId: privilegeDoc.actorIdentityId as string,
-          projectMembershipId: privilegeDoc.projectId as string,
           projectId: privilegeDoc.projectId as string,
           slug: privilege.name
         }
@@ -222,7 +220,6 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         privilege: {
           ...privilege,
           identityId: privilegeDoc.actorIdentityId as string,
-          projectMembershipId: privilegeDoc.projectId as string,
           projectId: privilegeDoc.projectId as string,
           slug: privilege.name
         }
@@ -276,7 +273,6 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         privilege: {
           ...privilege,
           identityId: privilegeDoc.actorIdentityId as string,
-          projectMembershipId: privilegeDoc.projectId as string,
           projectId: privilegeDoc.projectId as string,
           slug: privilege.name
         }
@@ -339,7 +335,6 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         privilege: {
           ...privilege,
           identityId: req.query.identityId,
-          projectMembershipId: privilege.projectId as string,
           projectId,
           slug: privilege.name
         }
@@ -391,7 +386,6 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         privileges: privileges.map((privilege) => ({
           ...privilege,
           identityId: req.query.identityId,
-          projectMembershipId: privilege.projectId as string,
           projectId: req.query.projectId,
           slug: privilege.name
         }))

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -4173,7 +4173,7 @@ interface PamResourceCreateEvent {
   type: EventType.PAM_RESOURCE_CREATE;
   metadata: {
     resourceType: string;
-    gatewayId: string;
+    gatewayId?: string;
     name: string;
   };
 }

backend/src/ee/services/pam-account/pam-account-fns.ts

@@ -72,17 +72,24 @@ export const decryptAccount = async <
   account: T,
   projectId: string,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
-): Promise<T & { credentials: TPamAccountCredentials; lastRotationMessage: string | null }> => {
+): Promise<
+  Omit<T, "encryptedCredentials" | "encryptedLastRotationMessage"> & {
+    credentials: TPamAccountCredentials;
+    lastRotationMessage: string | null;
+  }
+> => {
+  const { encryptedCredentials, encryptedLastRotationMessage, ...rest } = account;
+
   return {
-    ...account,
+    ...rest,
     credentials: await decryptAccountCredentials({
-      encryptedCredentials: account.encryptedCredentials,
+      encryptedCredentials,
       projectId,
       kmsService
     }),
-    lastRotationMessage: account.encryptedLastRotationMessage
+    lastRotationMessage: encryptedLastRotationMessage
       ? await decryptAccountMessage({
-          encryptedMessage: account.encryptedLastRotationMessage,
+          encryptedMessage: encryptedLastRotationMessage,
           projectId,
           kmsService
         })

backend/src/ee/services/pam-account/pam-account-service.ts

@@ -3,6 +3,11 @@ import path from "node:path";
 import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType, OrganizationActionScope, TPamAccounts, TPamFolders, TPamResources } from "@app/db/schemas";
+import {
+  extractAwsAccountIdFromArn,
+  generateConsoleFederationUrl,
+  TAwsIamAccountCredentials
+} from "@app/ee/services/pam-resource/aws-iam";
 import { PAM_RESOURCE_FACTORY_MAP } from "@app/ee/services/pam-resource/pam-resource-factory";
 import { decryptResource, decryptResourceConnectionDetails } from "@app/ee/services/pam-resource/pam-resource-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
@@ -30,6 +35,7 @@ import { APPROVAL_POLICY_FACTORY_MAP } from "@app/services/approval-policy/appro
 import { ActorType } from "@app/services/auth/auth-type";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
+import { TPamSessionExpirationServiceFactory } from "@app/services/pam-session-expiration/pam-session-expiration-queue";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 
@@ -41,7 +47,8 @@ import { getFullPamFolderPath } from "../pam-folder/pam-folder-fns";
 import { TPamResourceDALFactory } from "../pam-resource/pam-resource-dal";
 import { PamResource } from "../pam-resource/pam-resource-enums";
 import { TPamAccountCredentials } from "../pam-resource/pam-resource-types";
-import { TSqlResourceConnectionDetails } from "../pam-resource/shared/sql/sql-resource-types";
+import { TSqlAccountCredentials, TSqlResourceConnectionDetails } from "../pam-resource/shared/sql/sql-resource-types";
+import { TSSHAccountCredentials } from "../pam-resource/ssh/ssh-resource-types";
 import { TPamSessionDALFactory } from "../pam-session/pam-session-dal";
 import { PamSessionStatus } from "../pam-session/pam-session-enums";
 import { OrgPermissionGatewayActions, OrgPermissionSubjects } from "../permission/org-permission";
@@ -67,6 +74,7 @@ type TPamAccountServiceFactoryDep = {
   auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
   approvalPolicyDAL: TApprovalPolicyDALFactory;
   approvalRequestGrantsDAL: TApprovalRequestGrantsDALFactory;
+  pamSessionExpirationService: Pick<TPamSessionExpirationServiceFactory, "scheduleSessionExpiration">;
 };
 export type TPamAccountServiceFactory = ReturnType<typeof pamAccountServiceFactory>;
 
@@ -85,7 +93,8 @@ export const pamAccountServiceFactory = ({
   gatewayV2Service,
   auditLogService,
   approvalPolicyDAL,
-  approvalRequestGrantsDAL
+  approvalRequestGrantsDAL,
+  pamSessionExpirationService
 }: TPamAccountServiceFactoryDep) => {
   const create = async (
     {
@@ -153,7 +162,8 @@ export const pamAccountServiceFactory = ({
       resource.resourceType as PamResource,
       connectionDetails,
       resource.gatewayId,
-      gatewayV2Service
+      gatewayV2Service,
+      resource.projectId
     );
     const validatedCredentials = await factory.validateAccountCredentials(credentials);
 
@@ -268,7 +278,8 @@ export const pamAccountServiceFactory = ({
         resource.resourceType as PamResource,
         connectionDetails,
         resource.gatewayId,
-        gatewayV2Service
+        gatewayV2Service,
+        account.projectId
       );
 
       const decryptedCredentials = await decryptAccountCredentials({
@@ -297,17 +308,27 @@ export const pamAccountServiceFactory = ({
       return decryptAccount(account, account.projectId, kmsService);
     }
 
-    const updatedAccount = await pamAccountDAL.updateById(accountId, updateDoc);
+    try {
+      const updatedAccount = await pamAccountDAL.updateById(accountId, updateDoc);
 
-    return {
-      ...(await decryptAccount(updatedAccount, account.projectId, kmsService)),
-      resource: {
-        id: resource.id,
-        name: resource.name,
-        resourceType: resource.resourceType,
-        rotationCredentialsConfigured: !!resource.encryptedRotationAccountCredentials
+      return {
+        ...(await decryptAccount(updatedAccount, account.projectId, kmsService)),
+        resource: {
+          id: resource.id,
+          name: resource.name,
+          resourceType: resource.resourceType,
+          rotationCredentialsConfigured: !!resource.encryptedRotationAccountCredentials
+        }
+      };
+    } catch (err) {
+      if (err instanceof DatabaseError && (err.error as { code: string })?.code === DatabaseErrorCode.UniqueViolation) {
+        throw new BadRequestError({
+          message: `Account with name '${name}' already exists for this path`
+        });
       }
-    };
+
+      throw err;
+    }
   };
 
   const deleteById = async (id: string, actor: OrgServiceActor) => {
@@ -446,7 +467,7 @@ export const pamAccountServiceFactory = ({
     const totalCount = totalFolderCount + totalAccountCount;
 
     const decryptedAndPermittedAccounts: Array<
-      TPamAccounts & {
+      Omit<TPamAccounts, "encryptedCredentials" | "encryptedLastRotationMessage"> & {
         resource: Pick<TPamResources, "id" | "name" | "resourceType"> & { rotationCredentialsConfigured: boolean };
         credentials: TPamAccountCredentials;
         lastRotationMessage: string | null;
@@ -594,6 +615,64 @@ export const pamAccountServiceFactory = ({
       );
     }
 
+    const { connectionDetails, gatewayId, resourceType } = await decryptResource(
+      resource,
+      account.projectId,
+      kmsService
+    );
+
+    const user = await userDAL.findById(actor.id);
+    if (!user) throw new NotFoundError({ message: `User with ID '${actor.id}' not found` });
+
+    if (resourceType === PamResource.AwsIam) {
+      const awsCredentials = (await decryptAccountCredentials({
+        encryptedCredentials: account.encryptedCredentials,
+        kmsService,
+        projectId: account.projectId
+      })) as TAwsIamAccountCredentials;
+
+      const { consoleUrl, expiresAt } = await generateConsoleFederationUrl({
+        connectionDetails,
+        targetRoleArn: awsCredentials.targetRoleArn,
+        roleSessionName: actorEmail,
+        projectId: account.projectId, // Use project ID as External ID for security
+        sessionDuration: awsCredentials.defaultSessionDuration
+      });
+
+      const session = await pamSessionDAL.create({
+        accountName: account.name,
+        actorEmail,
+        actorIp,
+        actorName,
+        actorUserAgent,
+        projectId: account.projectId,
+        resourceName: resource.name,
+        resourceType: resource.resourceType,
+        status: PamSessionStatus.Active, // AWS IAM sessions are immediately active
+        accountId: account.id,
+        userId: actor.id,
+        expiresAt,
+        startedAt: new Date()
+      });
+
+      // Schedule session expiration job to run at expiresAt
+      await pamSessionExpirationService.scheduleSessionExpiration(session.id, expiresAt);
+
+      return {
+        sessionId: session.id,
+        resourceType,
+        account,
+        consoleUrl,
+        metadata: {
+          awsAccountId: extractAwsAccountIdFromArn(connectionDetails.roleArn),
+          targetRoleArn: awsCredentials.targetRoleArn,
+          federatedUsername: actorEmail,
+          expiresAt: expiresAt.toISOString()
+        }
+      };
+    }
+
+    // For gateway-based resources (Postgres, MySQL, SSH), create session first
     const session = await pamSessionDAL.create({
       accountName: account.name,
       actorEmail,
@@ -609,18 +688,17 @@ export const pamAccountServiceFactory = ({
       expiresAt: new Date(Date.now() + duration)
     });
 
-    const { connectionDetails, gatewayId, resourceType } = await decryptResource(resource, projectId, kmsService);
-
-    const user = await userDAL.findById(actor.id);
-    if (!user) throw new NotFoundError({ message: `User with ID '${actor.id}' not found` });
+    if (!gatewayId) {
+      throw new BadRequestError({ message: "Gateway ID is required for this resource type" });
+    }
 
     const gatewayConnectionDetails = await gatewayV2Service.getPAMConnectionDetails({
       gatewayId,
       duration,
       sessionId: session.id,
       resourceType: resource.resourceType as PamResource,
-      host: connectionDetails.host,
-      port: connectionDetails.port,
+      host: (connectionDetails as TSqlResourceConnectionDetails).host,
+      port: (connectionDetails as TSqlResourceConnectionDetails).port,
       actorMetadata: {
         id: actor.id,
         type: actor.type,
@@ -644,11 +722,11 @@ export const pamAccountServiceFactory = ({
             projectId
           })) as TSqlResourceConnectionDetails;
 
-          const credentials = await decryptAccountCredentials({
+          const credentials = (await decryptAccountCredentials({
             encryptedCredentials: account.encryptedCredentials,
             kmsService,
             projectId
-          });
+          })) as TSqlAccountCredentials;
 
           metadata = {
             username: credentials.username,
@@ -660,11 +738,11 @@ export const pamAccountServiceFactory = ({
         break;
       case PamResource.SSH:
         {
-          const credentials = await decryptAccountCredentials({
+          const credentials = (await decryptAccountCredentials({
             encryptedCredentials: account.encryptedCredentials,
             kmsService,
             projectId
-          });
+          })) as TSSHAccountCredentials;
 
           metadata = {
             username: credentials.username
@@ -737,7 +815,7 @@ export const pamAccountServiceFactory = ({
     const resource = await pamResourceDAL.findById(account.resourceId);
     if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
 
-    if (resource.gatewayIdentityId !== actor.id) {
+    if (resource.gatewayId && resource.gatewayIdentityId !== actor.id) {
       throw new ForbiddenRequestError({
         message: "Identity does not have access to fetch the PAM session credentials"
       });
@@ -801,7 +879,8 @@ export const pamAccountServiceFactory = ({
               resourceType as PamResource,
               connectionDetails,
               gatewayId,
-              gatewayV2Service
+              gatewayV2Service,
+              account.projectId
             );
 
             const newCredentials = await factory.rotateAccountCredentials(

backend/src/ee/services/pam-account/pam-account-types.ts

@@ -6,8 +6,10 @@ import { PamAccountOrderBy, PamAccountView } from "./pam-account-enums";
 // DTOs
 export type TCreateAccountDTO = Pick<
   TPamAccount,
-  "name" | "description" | "credentials" | "folderId" | "resourceId" | "rotationEnabled" | "rotationIntervalSeconds"
->;
+  "name" | "description" | "credentials" | "folderId" | "resourceId" | "rotationIntervalSeconds"
+> & {
+  rotationEnabled?: boolean;
+};
 
 export type TUpdateAccountDTO = Partial<Omit<TCreateAccountDTO, "folderId" | "resourceId">> & {
   accountId: string;

backend/src/ee/services/pam-resource/aws-iam/aws-iam-federation.ts

@@ -0,0 +1,245 @@
+import { AssumeRoleCommand, Credentials, STSClient, STSClientConfig } from "@aws-sdk/client-sts";
+
+import { CustomAWSHasher } from "@app/lib/aws/hashing";
+import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { BadRequestError, InternalServerError } from "@app/lib/errors";
+
+import { TAwsIamResourceConnectionDetails } from "./aws-iam-resource-types";
+
+const AWS_STS_MIN_DURATION_SECONDS = 900;
+
+// We hardcode us-east-1 because:
+// 1. IAM is global - roles can be assumed from any STS regional endpoint
+// 2. The temporary credentials returned work globally across all AWS regions
+// 3. The target account's resources can be in any region - it doesn't affect STS calls
+const AWS_STS_DEFAULT_REGION = "us-east-1";
+
+const createStsClient = (credentials?: Credentials): STSClient => {
+  const appCfg = getConfig();
+
+  const config: STSClientConfig = {
+    region: AWS_STS_DEFAULT_REGION,
+    useFipsEndpoint: crypto.isFipsModeEnabled(),
+    sha256: CustomAWSHasher
+  };
+
+  if (credentials) {
+    // Use provided credentials (for role chaining)
+    config.credentials = {
+      accessKeyId: credentials.AccessKeyId!,
+      secretAccessKey: credentials.SecretAccessKey!,
+      sessionToken: credentials.SessionToken
+    };
+  } else if (appCfg.PAM_AWS_ACCESS_KEY_ID && appCfg.PAM_AWS_SECRET_ACCESS_KEY) {
+    // Use configured static credentials
+    config.credentials = {
+      accessKeyId: appCfg.PAM_AWS_ACCESS_KEY_ID,
+      secretAccessKey: appCfg.PAM_AWS_SECRET_ACCESS_KEY
+    };
+  }
+  // Otherwise uses instance profile if hosting on AWS
+
+  return new STSClient(config);
+};
+
+/**
+ * Assumes the PAM role and returns the credentials.
+ * Returns null if assumption fails (for validation) or throws if throwOnError is true.
+ */
+const assumePamRole = async ({
+  connectionDetails,
+  projectId,
+  sessionDuration = AWS_STS_MIN_DURATION_SECONDS,
+  sessionNameSuffix = "validation",
+  throwOnError = false
+}: {
+  connectionDetails: TAwsIamResourceConnectionDetails;
+  projectId: string;
+  sessionDuration?: number;
+  sessionNameSuffix?: string;
+  throwOnError?: boolean;
+}): Promise<Credentials | null> => {
+  const stsClient = createStsClient();
+
+  try {
+    const result = await stsClient.send(
+      new AssumeRoleCommand({
+        RoleArn: connectionDetails.roleArn,
+        RoleSessionName: `infisical-pam-${sessionNameSuffix}-${Date.now()}`,
+        DurationSeconds: sessionDuration,
+        ExternalId: projectId
+      })
+    );
+
+    if (!result.Credentials) {
+      if (throwOnError) {
+        throw new InternalServerError({
+          message: "Failed to assume PAM role - AWS STS did not return credentials"
+        });
+      }
+      return null;
+    }
+
+    return result.Credentials;
+  } catch (error) {
+    if (throwOnError) {
+      throw new InternalServerError({
+        message: `Failed to assume PAM role - AWS STS did not return credentials: ${error instanceof Error ? error.message : "Unknown error"}`
+      });
+    }
+    return null;
+  }
+};
+
+/**
+ * Assumes a target role using PAM role credentials (role chaining).
+ * Returns null if assumption fails (for validation) or throws if throwOnError is true.
+ */
+const assumeTargetRole = async ({
+  pamCredentials,
+  targetRoleArn,
+  projectId,
+  roleSessionName,
+  sessionDuration = AWS_STS_MIN_DURATION_SECONDS,
+  throwOnError = false
+}: {
+  pamCredentials: Credentials;
+  targetRoleArn: string;
+  projectId: string;
+  roleSessionName: string;
+  sessionDuration?: number;
+  throwOnError?: boolean;
+}): Promise<Credentials | null> => {
+  const chainedStsClient = createStsClient(pamCredentials);
+
+  try {
+    const result = await chainedStsClient.send(
+      new AssumeRoleCommand({
+        RoleArn: targetRoleArn,
+        RoleSessionName: roleSessionName,
+        DurationSeconds: sessionDuration,
+        ExternalId: projectId
+      })
+    );
+
+    if (!result.Credentials) {
+      if (throwOnError) {
+        throw new BadRequestError({
+          message: "Failed to assume target role - verify the target role trust policy allows the PAM role to assume it"
+        });
+      }
+      return null;
+    }
+
+    return result.Credentials;
+  } catch (error) {
+    if (throwOnError) {
+      throw new InternalServerError({
+        message: `Failed to assume target role - AWS STS did not return credentials: ${error instanceof Error ? error.message : "Unknown error"}`
+      });
+    }
+    return null;
+  }
+};
+
+export const validatePamRoleConnection = async (
+  connectionDetails: TAwsIamResourceConnectionDetails,
+  projectId: string
+): Promise<boolean> => {
+  try {
+    const credentials = await assumePamRole({ connectionDetails, projectId });
+    return credentials !== null;
+  } catch {
+    return false;
+  }
+};
+
+export const validateTargetRoleAssumption = async ({
+  connectionDetails,
+  targetRoleArn,
+  projectId
+}: {
+  connectionDetails: TAwsIamResourceConnectionDetails;
+  targetRoleArn: string;
+  projectId: string;
+}): Promise<boolean> => {
+  try {
+    const pamCredentials = await assumePamRole({ connectionDetails, projectId });
+    if (!pamCredentials) return false;
+
+    const targetCredentials = await assumeTargetRole({
+      pamCredentials,
+      targetRoleArn,
+      projectId,
+      roleSessionName: `infisical-pam-target-validation-${Date.now()}`
+    });
+    return targetCredentials !== null;
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * Assumes the target role and generates a federated console sign-in URL.
+ */
+export const generateConsoleFederationUrl = async ({
+  connectionDetails,
+  targetRoleArn,
+  roleSessionName,
+  projectId,
+  sessionDuration
+}: {
+  connectionDetails: TAwsIamResourceConnectionDetails;
+  targetRoleArn: string;
+  roleSessionName: string;
+  projectId: string;
+  sessionDuration: number;
+}): Promise<{ consoleUrl: string; expiresAt: Date }> => {
+  const pamCredentials = await assumePamRole({
+    connectionDetails,
+    projectId,
+    sessionDuration,
+    sessionNameSuffix: "session",
+    throwOnError: true
+  });
+
+  const targetCredentials = await assumeTargetRole({
+    pamCredentials: pamCredentials!,
+    targetRoleArn,
+    projectId,
+    roleSessionName,
+    sessionDuration,
+    throwOnError: true
+  });
+
+  const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = targetCredentials!;
+
+  // Generate federation URL
+  const sessionJson = JSON.stringify({
+    sessionId: AccessKeyId,
+    sessionKey: SecretAccessKey,
+    sessionToken: SessionToken
+  });
+
+  const federationEndpoint = "https://signin.aws.amazon.com/federation";
+
+  const signinTokenUrl = `${federationEndpoint}?Action=getSigninToken&Session=${encodeURIComponent(sessionJson)}`;
+
+  const tokenResponse = await request.get<{ SigninToken?: string }>(signinTokenUrl);
+
+  if (!tokenResponse.data.SigninToken) {
+    throw new InternalServerError({
+      message: `AWS federation endpoint did not return a SigninToken: ${JSON.stringify(tokenResponse.data).substring(0, 200)}`
+    });
+  }
+
+  const consoleDestination = `https://console.aws.amazon.com/`;
+  const consoleUrl = `${federationEndpoint}?Action=login&SigninToken=${encodeURIComponent(tokenResponse.data.SigninToken)}&Destination=${encodeURIComponent(consoleDestination)}`;
+
+  return {
+    consoleUrl,
+    expiresAt: Expiration ?? new Date(Date.now() + sessionDuration * 1000)
+  };
+};

backend/src/ee/services/pam-resource/aws-iam/aws-iam-resource-factory.ts

@@ -0,0 +1,110 @@
+import { BadRequestError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
+
+import { PamResource } from "../pam-resource-enums";
+import {
+  TPamResourceFactory,
+  TPamResourceFactoryRotateAccountCredentials,
+  TPamResourceFactoryValidateAccountCredentials
+} from "../pam-resource-types";
+import { validatePamRoleConnection, validateTargetRoleAssumption } from "./aws-iam-federation";
+import { TAwsIamAccountCredentials, TAwsIamResourceConnectionDetails } from "./aws-iam-resource-types";
+
+export const awsIamResourceFactory: TPamResourceFactory<TAwsIamResourceConnectionDetails, TAwsIamAccountCredentials> = (
+  resourceType: PamResource,
+  connectionDetails: TAwsIamResourceConnectionDetails,
+  // AWS IAM doesn't use gateway
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  _gatewayId,
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  _gatewayV2Service,
+  projectId
+) => {
+  const validateConnection = async () => {
+    try {
+      const isValid = await validatePamRoleConnection(connectionDetails, projectId ?? "");
+
+      if (!isValid) {
+        throw new BadRequestError({
+          message:
+            "Unable to assume the PAM role. Verify the role ARN and ensure the trust policy allows Infisical to assume the role."
+        });
+      }
+
+      logger.info(
+        { roleArn: connectionDetails.roleArn },
+        "[AWS IAM Resource Factory] PAM role connection validated successfully"
+      );
+
+      return connectionDetails;
+    } catch (error) {
+      if (error instanceof BadRequestError) {
+        throw error;
+      }
+
+      logger.error(error, "[AWS IAM Resource Factory] Failed to validate PAM role connection");
+
+      throw new BadRequestError({
+        message: `Unable to validate connection to ${resourceType}: ${(error as Error).message || String(error)}`
+      });
+    }
+  };
+
+  const validateAccountCredentials: TPamResourceFactoryValidateAccountCredentials<TAwsIamAccountCredentials> = async (
+    credentials
+  ) => {
+    try {
+      const isValid = await validateTargetRoleAssumption({
+        connectionDetails,
+        targetRoleArn: credentials.targetRoleArn,
+        projectId: projectId ?? ""
+      });
+
+      if (!isValid) {
+        throw new BadRequestError({
+          message: `Unable to assume the target role. Verify the target role ARN and ensure the PAM role (ARN: ${connectionDetails.roleArn}) has permission to assume it.`
+        });
+      }
+
+      logger.info(
+        { targetRoleArn: credentials.targetRoleArn },
+        "[AWS IAM Resource Factory] Target role credentials validated successfully"
+      );
+
+      return credentials;
+    } catch (error) {
+      if (error instanceof BadRequestError) {
+        throw error;
+      }
+
+      logger.error(error, "[AWS IAM Resource Factory] Failed to validate target role credentials");
+
+      throw new BadRequestError({
+        message: `Unable to validate account credentials for ${resourceType}: ${(error as Error).message || String(error)}`
+      });
+    }
+  };
+
+  const rotateAccountCredentials: TPamResourceFactoryRotateAccountCredentials<TAwsIamAccountCredentials> = async (
+    _rotationAccountCredentials,
+    currentCredentials
+  ) => {
+    return currentCredentials;
+  };
+
+  const handleOverwritePreventionForCensoredValues = async (
+    updatedAccountCredentials: TAwsIamAccountCredentials,
+    // AWS IAM has no censored credential values - role ARNs are not secrets
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    _currentCredentials: TAwsIamAccountCredentials
+  ) => {
+    return updatedAccountCredentials;
+  };
+
+  return {
+    validateConnection,
+    validateAccountCredentials,
+    rotateAccountCredentials,
+    handleOverwritePreventionForCensoredValues
+  };
+};

backend/src/ee/services/pam-resource/aws-iam/aws-iam-resource-fns.ts

@@ -0,0 +1,24 @@
+import RE2 from "re2";
+
+import { BadRequestError } from "@app/lib/errors";
+
+import { AwsIamResourceListItemSchema } from "./aws-iam-resource-schemas";
+
+export const getAwsIamResourceListItem = () => {
+  return {
+    name: AwsIamResourceListItemSchema.shape.name.value,
+    resource: AwsIamResourceListItemSchema.shape.resource.value
+  };
+};
+
+/**
+ * Extract the AWS Account ID from an IAM Role ARN
+ * ARN format: arn:aws:iam::123456789012:role/RoleName
+ */
+export const extractAwsAccountIdFromArn = (roleArn: string): string => {
+  const match = roleArn.match(new RE2("^arn:aws:iam::(\\d{12}):role/"));
+  if (!match) {
+    throw new BadRequestError({ message: "Invalid IAM Role ARN format" });
+  }
+  return match[1];
+};

backend/src/ee/services/pam-resource/aws-iam/aws-iam-resource-schemas.ts

@@ -0,0 +1,81 @@
+import { z } from "zod";
+
+import { PamResource } from "../pam-resource-enums";
+import {
+  BaseCreatePamAccountSchema,
+  BaseCreatePamResourceSchema,
+  BasePamAccountSchema,
+  BasePamAccountSchemaWithResource,
+  BasePamResourceSchema,
+  BaseUpdatePamAccountSchema,
+  BaseUpdatePamResourceSchema
+} from "../pam-resource-schemas";
+
+// AWS STS session duration limits (in seconds)
+// Role chaining (Infisical → PAM role → target role) limits max session to 1 hour
+// @see https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
+const AWS_STS_MIN_SESSION_DURATION = 900; // 15 minutes
+const AWS_STS_MAX_SESSION_DURATION_ROLE_CHAINING = 3600; // 1 hour
+
+export const AwsIamResourceConnectionDetailsSchema = z.object({
+  roleArn: z.string().trim().min(1)
+});
+
+export const AwsIamAccountCredentialsSchema = z.object({
+  targetRoleArn: z.string().trim().min(1).max(2048),
+  defaultSessionDuration: z.coerce
+    .number()
+    .min(AWS_STS_MIN_SESSION_DURATION)
+    .max(AWS_STS_MAX_SESSION_DURATION_ROLE_CHAINING)
+});
+
+const BaseAwsIamResourceSchema = BasePamResourceSchema.extend({
+  resourceType: z.literal(PamResource.AwsIam),
+  gatewayId: z.string().uuid().nullable().optional()
+});
+
+export const AwsIamResourceSchema = BaseAwsIamResourceSchema.extend({
+  connectionDetails: AwsIamResourceConnectionDetailsSchema,
+  rotationAccountCredentials: AwsIamAccountCredentialsSchema.nullable().optional()
+});
+
+export const SanitizedAwsIamResourceSchema = BaseAwsIamResourceSchema.extend({
+  connectionDetails: AwsIamResourceConnectionDetailsSchema,
+  rotationAccountCredentials: AwsIamAccountCredentialsSchema.nullable().optional()
+});
+
+export const AwsIamResourceListItemSchema = z.object({
+  name: z.literal("AWS IAM"),
+  resource: z.literal(PamResource.AwsIam)
+});
+
+export const CreateAwsIamResourceSchema = BaseCreatePamResourceSchema.extend({
+  connectionDetails: AwsIamResourceConnectionDetailsSchema,
+  rotationAccountCredentials: AwsIamAccountCredentialsSchema.nullable().optional()
+});
+
+export const UpdateAwsIamResourceSchema = BaseUpdatePamResourceSchema.extend({
+  connectionDetails: AwsIamResourceConnectionDetailsSchema.optional(),
+  rotationAccountCredentials: AwsIamAccountCredentialsSchema.nullable().optional()
+});
+
+export const AwsIamAccountSchema = BasePamAccountSchema.extend({
+  credentials: AwsIamAccountCredentialsSchema
+});
+
+export const CreateAwsIamAccountSchema = BaseCreatePamAccountSchema.extend({
+  credentials: AwsIamAccountCredentialsSchema,
+  // AWS IAM accounts don't support credential rotation - they use role assumption
+  rotationEnabled: z.boolean().default(false)
+});
+
+export const UpdateAwsIamAccountSchema = BaseUpdatePamAccountSchema.extend({
+  credentials: AwsIamAccountCredentialsSchema.optional()
+});
+
+export const SanitizedAwsIamAccountWithResourceSchema = BasePamAccountSchemaWithResource.extend({
+  credentials: AwsIamAccountCredentialsSchema.pick({
+    targetRoleArn: true,
+    defaultSessionDuration: true
+  })
+});

backend/src/ee/services/pam-resource/aws-iam/aws-iam-resource-types.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+
+import {
+  AwsIamAccountCredentialsSchema,
+  AwsIamAccountSchema,
+  AwsIamResourceConnectionDetailsSchema,
+  AwsIamResourceSchema
+} from "./aws-iam-resource-schemas";
+
+// Resources
+export type TAwsIamResource = z.infer<typeof AwsIamResourceSchema>;
+export type TAwsIamResourceConnectionDetails = z.infer<typeof AwsIamResourceConnectionDetailsSchema>;
+
+// Accounts
+export type TAwsIamAccount = z.infer<typeof AwsIamAccountSchema>;
+export type TAwsIamAccountCredentials = z.infer<typeof AwsIamAccountCredentialsSchema>;

backend/src/ee/services/pam-resource/aws-iam/index.ts

@@ -0,0 +1,5 @@
+export * from "./aws-iam-federation";
+export * from "./aws-iam-resource-factory";
+export * from "./aws-iam-resource-fns";
+export * from "./aws-iam-resource-schemas";
+export * from "./aws-iam-resource-types";

backend/src/ee/services/pam-resource/mysql/mysql-resource-schemas.ts

@@ -2,13 +2,13 @@ import { z } from "zod";
 
 import { PamResource } from "../pam-resource-enums";
 import {
+  BaseCreateGatewayPamResourceSchema,
   BaseCreatePamAccountSchema,
-  BaseCreatePamResourceSchema,
   BasePamAccountSchema,
   BasePamAccountSchemaWithResource,
   BasePamResourceSchema,
-  BaseUpdatePamAccountSchema,
-  BaseUpdatePamResourceSchema
+  BaseUpdateGatewayPamResourceSchema,
+  BaseUpdatePamAccountSchema
 } from "../pam-resource-schemas";
 import {
   BaseSqlAccountCredentialsSchema,
@@ -43,12 +43,12 @@ export const MySQLResourceListItemSchema = z.object({
   resource: z.literal(PamResource.MySQL)
 });
 
-export const CreateMySQLResourceSchema = BaseCreatePamResourceSchema.extend({
+export const CreateMySQLResourceSchema = BaseCreateGatewayPamResourceSchema.extend({
   connectionDetails: MySQLResourceConnectionDetailsSchema,
   rotationAccountCredentials: MySQLAccountCredentialsSchema.nullable().optional()
 });
 
-export const UpdateMySQLResourceSchema = BaseUpdatePamResourceSchema.extend({
+export const UpdateMySQLResourceSchema = BaseUpdateGatewayPamResourceSchema.extend({
   connectionDetails: MySQLResourceConnectionDetailsSchema.optional(),
   rotationAccountCredentials: MySQLAccountCredentialsSchema.nullable().optional()
 });

backend/src/ee/services/pam-resource/pam-resource-dal.ts

@@ -14,7 +14,7 @@ export const pamResourceDALFactory = (db: TDbClient) => {
 
   const findById = async (id: string, tx?: Knex) => {
     const doc = await (tx || db.replicaNode())(TableName.PamResource)
-      .join(TableName.GatewayV2, `${TableName.PamResource}.gatewayId`, `${TableName.GatewayV2}.id`)
+      .leftJoin(TableName.GatewayV2, `${TableName.PamResource}.gatewayId`, `${TableName.GatewayV2}.id`)
       .select(selectAllTableCols(TableName.PamResource))
       .select(db.ref("name").withSchema(TableName.GatewayV2).as("gatewayName"))
       .select(db.ref("identityId").withSchema(TableName.GatewayV2).as("gatewayIdentityId"))

backend/src/ee/services/pam-resource/pam-resource-enums.ts

@@ -1,7 +1,8 @@
 export enum PamResource {
   Postgres = "postgres",
   MySQL = "mysql",
-  SSH = "ssh"
+  SSH = "ssh",
+  AwsIam = "aws-iam"
 }
 
 export enum PamResourceOrderBy {

backend/src/ee/services/pam-resource/pam-resource-factory.ts

@@ -1,3 +1,4 @@
+import { awsIamResourceFactory } from "./aws-iam/aws-iam-resource-factory";
 import { PamResource } from "./pam-resource-enums";
 import { TPamAccountCredentials, TPamResourceConnectionDetails, TPamResourceFactory } from "./pam-resource-types";
 import { sqlResourceFactory } from "./shared/sql/sql-resource-factory";
@@ -8,5 +9,6 @@ type TPamResourceFactoryImplementation = TPamResourceFactory<TPamResourceConnect
 export const PAM_RESOURCE_FACTORY_MAP: Record<PamResource, TPamResourceFactoryImplementation> = {
   [PamResource.Postgres]: sqlResourceFactory as TPamResourceFactoryImplementation,
   [PamResource.MySQL]: sqlResourceFactory as TPamResourceFactoryImplementation,
-  [PamResource.SSH]: sshResourceFactory as TPamResourceFactoryImplementation
+  [PamResource.SSH]: sshResourceFactory as TPamResourceFactoryImplementation,
+  [PamResource.AwsIam]: awsIamResourceFactory as TPamResourceFactoryImplementation
 };

backend/src/ee/services/pam-resource/pam-resource-fns.ts

@@ -3,12 +3,15 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
 import { decryptAccountCredentials } from "../pam-account/pam-account-fns";
+import { getAwsIamResourceListItem } from "./aws-iam/aws-iam-resource-fns";
 import { getMySQLResourceListItem } from "./mysql/mysql-resource-fns";
 import { TPamResource, TPamResourceConnectionDetails } from "./pam-resource-types";
 import { getPostgresResourceListItem } from "./postgres/postgres-resource-fns";
 
 export const listResourceOptions = () => {
-  return [getPostgresResourceListItem(), getMySQLResourceListItem()].sort((a, b) => a.name.localeCompare(b.name));
+  return [getPostgresResourceListItem(), getMySQLResourceListItem(), getAwsIamResourceListItem()].sort((a, b) =>
+    a.name.localeCompare(b.name)
+  );
 };
 
 // Resource

backend/src/ee/services/pam-resource/pam-resource-schemas.ts

@@ -3,6 +3,18 @@ import { z } from "zod";
 import { PamAccountsSchema, PamResourcesSchema } from "@app/db/schemas";
 import { slugSchema } from "@app/server/lib/schemas";
 
+export const GatewayAccessResponseSchema = z.object({
+  sessionId: z.string(),
+  relayClientCertificate: z.string(),
+  relayClientPrivateKey: z.string(),
+  relayServerCertificateChain: z.string(),
+  gatewayClientCertificate: z.string(),
+  gatewayClientPrivateKey: z.string(),
+  gatewayServerCertificateChain: z.string(),
+  relayHost: z.string(),
+  metadata: z.record(z.string(), z.string().optional()).optional()
+});
+
 // Resources
 export const BasePamResourceSchema = PamResourcesSchema.omit({
   encryptedConnectionDetails: true,
@@ -10,17 +22,27 @@ export const BasePamResourceSchema = PamResourcesSchema.omit({
   resourceType: true
 });
 
-export const BaseCreatePamResourceSchema = z.object({
+const CoreCreatePamResourceSchema = z.object({
   projectId: z.string().uuid(),
-  gatewayId: z.string().uuid(),
   name: slugSchema({ field: "name" })
 });
 
-export const BaseUpdatePamResourceSchema = z.object({
-  gatewayId: z.string().uuid().optional(),
+export const BaseCreateGatewayPamResourceSchema = CoreCreatePamResourceSchema.extend({
+  gatewayId: z.string().uuid()
+});
+
+export const BaseCreatePamResourceSchema = CoreCreatePamResourceSchema;
+
+const CoreUpdatePamResourceSchema = z.object({
   name: slugSchema({ field: "name" }).optional()
 });
 
+export const BaseUpdateGatewayPamResourceSchema = CoreUpdatePamResourceSchema.extend({
+  gatewayId: z.string().uuid().optional()
+});
+
+export const BaseUpdatePamResourceSchema = CoreUpdatePamResourceSchema;
+
 // Accounts
 export const BasePamAccountSchema = PamAccountsSchema.omit({
   encryptedCredentials: true

backend/src/ee/services/pam-resource/pam-resource-service.ts

@@ -92,7 +92,8 @@ export const pamResourceServiceFactory = ({
       resourceType,
       connectionDetails,
       gatewayId,
-      gatewayV2Service
+      gatewayV2Service,
+      projectId
     );
 
     const validatedConnectionDetails = await factory.validateConnection();
@@ -162,7 +163,8 @@ export const pamResourceServiceFactory = ({
         resource.resourceType as PamResource,
         connectionDetails,
         resource.gatewayId,
-        gatewayV2Service
+        gatewayV2Service,
+        resource.projectId
       );
       const validatedConnectionDetails = await factory.validateConnection();
       const encryptedConnectionDetails = await encryptResourceConnectionDetails({
@@ -189,7 +191,8 @@ export const pamResourceServiceFactory = ({
           resource.resourceType as PamResource,
           decryptedConnectionDetails,
           resource.gatewayId,
-          gatewayV2Service
+          gatewayV2Service,
+          resource.projectId
         );
 
         let finalCredentials = { ...rotationAccountCredentials };

backend/src/ee/services/pam-resource/pam-resource-types.ts

@@ -1,6 +1,12 @@
 import { OrderByDirection, TProjectPermission } from "@app/lib/types";
 
 import { TGatewayV2ServiceFactory } from "../gateway-v2/gateway-v2-service";
+import {
+  TAwsIamAccount,
+  TAwsIamAccountCredentials,
+  TAwsIamResource,
+  TAwsIamResourceConnectionDetails
+} from "./aws-iam/aws-iam-resource-types";
 import {
   TMySQLAccount,
   TMySQLAccountCredentials,
@@ -22,22 +28,28 @@ import {
 } from "./ssh/ssh-resource-types";
 
 // Resource types
-export type TPamResource = TPostgresResource | TMySQLResource | TSSHResource;
+export type TPamResource = TPostgresResource | TMySQLResource | TSSHResource | TAwsIamResource;
 export type TPamResourceConnectionDetails =
   | TPostgresResourceConnectionDetails
   | TMySQLResourceConnectionDetails
-  | TSSHResourceConnectionDetails;
+  | TSSHResourceConnectionDetails
+  | TAwsIamResourceConnectionDetails;
 
 // Account types
-export type TPamAccount = TPostgresAccount | TMySQLAccount | TSSHAccount;
-// eslint-disable-next-line @typescript-eslint/no-duplicate-type-constituents
-export type TPamAccountCredentials = TPostgresAccountCredentials | TMySQLAccountCredentials | TSSHAccountCredentials;
+export type TPamAccount = TPostgresAccount | TMySQLAccount | TSSHAccount | TAwsIamAccount;
+
+export type TPamAccountCredentials =
+  | TPostgresAccountCredentials
+  // eslint-disable-next-line @typescript-eslint/no-duplicate-type-constituents
+  | TMySQLAccountCredentials
+  | TSSHAccountCredentials
+  | TAwsIamAccountCredentials;
 
 // Resource DTOs
-export type TCreateResourceDTO = Pick<
-  TPamResource,
-  "name" | "connectionDetails" | "resourceType" | "gatewayId" | "projectId" | "rotationAccountCredentials"
->;
+export type TCreateResourceDTO = Pick<TPamResource, "name" | "connectionDetails" | "resourceType" | "projectId"> & {
+  gatewayId?: string | null;
+  rotationAccountCredentials?: TPamAccountCredentials | null;
+};
 
 export type TUpdateResourceDTO = Partial<Omit<TCreateResourceDTO, "resourceType" | "projectId">> & {
   resourceId: string;
@@ -65,8 +77,9 @@ export type TPamResourceFactoryRotateAccountCredentials<C extends TPamAccountCre
 export type TPamResourceFactory<T extends TPamResourceConnectionDetails, C extends TPamAccountCredentials> = (
   resourceType: PamResource,
   connectionDetails: T,
-  gatewayId: string,
-  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">
+  gatewayId: string | null | undefined,
+  gatewayV2Service: Pick<TGatewayV2ServiceFactory, "getPlatformConnectionDetailsByGatewayId">,
+  projectId: string | null | undefined
 ) => {
   validateConnection: TPamResourceFactoryValidateConnection<T>;
   validateAccountCredentials: TPamResourceFactoryValidateAccountCredentials<C>;

backend/src/ee/services/pam-resource/postgres/postgres-resource-schemas.ts

@@ -2,13 +2,13 @@ import { z } from "zod";
 
 import { PamResource } from "../pam-resource-enums";
 import {
+  BaseCreateGatewayPamResourceSchema,
   BaseCreatePamAccountSchema,
-  BaseCreatePamResourceSchema,
   BasePamAccountSchema,
   BasePamAccountSchemaWithResource,
   BasePamResourceSchema,
-  BaseUpdatePamAccountSchema,
-  BaseUpdatePamResourceSchema
+  BaseUpdateGatewayPamResourceSchema,
+  BaseUpdatePamAccountSchema
 } from "../pam-resource-schemas";
 import {
   BaseSqlAccountCredentialsSchema,
@@ -40,12 +40,12 @@ export const PostgresResourceListItemSchema = z.object({
   resource: z.literal(PamResource.Postgres)
 });
 
-export const CreatePostgresResourceSchema = BaseCreatePamResourceSchema.extend({
+export const CreatePostgresResourceSchema = BaseCreateGatewayPamResourceSchema.extend({
   connectionDetails: PostgresResourceConnectionDetailsSchema,
   rotationAccountCredentials: PostgresAccountCredentialsSchema.nullable().optional()
 });
 
-export const UpdatePostgresResourceSchema = BaseUpdatePamResourceSchema.extend({
+export const UpdatePostgresResourceSchema = BaseUpdateGatewayPamResourceSchema.extend({
   connectionDetails: PostgresResourceConnectionDetailsSchema.optional(),
   rotationAccountCredentials: PostgresAccountCredentialsSchema.nullable().optional()
 });

backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts

@@ -233,6 +233,10 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
   gatewayV2Service
 ) => {
   const validateConnection = async () => {
+    if (!gatewayId) {
+      throw new BadRequestError({ message: "Gateway ID is required" });
+    }
+
     try {
       await executeWithGateway({ connectionDetails, gatewayId, resourceType }, gatewayV2Service, async (client) => {
         await client.validate(true);
@@ -255,6 +259,10 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
     credentials
   ) => {
     try {
+      if (!gatewayId) {
+        throw new BadRequestError({ message: "Gateway ID is required" });
+      }
+
       await executeWithGateway(
         {
           connectionDetails,
@@ -296,6 +304,10 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
     currentCredentials
   ) => {
     const newPassword = alphaNumericNanoId(32);
+    if (!gatewayId) {
+      throw new BadRequestError({ message: "Gateway ID is required" });
+    }
+
     try {
       return await executeWithGateway(
         {

backend/src/ee/services/pam-resource/ssh/ssh-resource-factory.ts

@@ -60,6 +60,10 @@ export const sshResourceFactory: TPamResourceFactory<TSSHResourceConnectionDetai
 ) => {
   const validateConnection = async () => {
     try {
+      if (!gatewayId) {
+        throw new BadRequestError({ message: "Gateway ID is required" });
+      }
+
       await executeWithGateway({ connectionDetails, gatewayId, resourceType }, gatewayV2Service, async (proxyPort) => {
         return new Promise<void>((resolve, reject) => {
           const client = new Client();
@@ -131,6 +135,10 @@ export const sshResourceFactory: TPamResourceFactory<TSSHResourceConnectionDetai
     credentials
   ) => {
     try {
+      if (!gatewayId) {
+        throw new BadRequestError({ message: "Gateway ID is required" });
+      }
+
       await executeWithGateway({ connectionDetails, gatewayId, resourceType }, gatewayV2Service, async (proxyPort) => {
         return new Promise<void>((resolve, reject) => {
           const client = new Client();

backend/src/ee/services/pam-resource/ssh/ssh-resource-schemas.ts

@@ -2,13 +2,13 @@ import { z } from "zod";
 
 import { PamResource } from "../pam-resource-enums";
 import {
+  BaseCreateGatewayPamResourceSchema,
   BaseCreatePamAccountSchema,
-  BaseCreatePamResourceSchema,
   BasePamAccountSchema,
   BasePamAccountSchemaWithResource,
   BasePamResourceSchema,
-  BaseUpdatePamAccountSchema,
-  BaseUpdatePamResourceSchema
+  BaseUpdateGatewayPamResourceSchema,
+  BaseUpdatePamAccountSchema
 } from "../pam-resource-schemas";
 import { SSHAuthMethod } from "./ssh-resource-enums";
 
@@ -73,12 +73,12 @@ export const SanitizedSSHResourceSchema = BaseSSHResourceSchema.extend({
     .optional()
 });
 
-export const CreateSSHResourceSchema = BaseCreatePamResourceSchema.extend({
+export const CreateSSHResourceSchema = BaseCreateGatewayPamResourceSchema.extend({
   connectionDetails: SSHResourceConnectionDetailsSchema,
   rotationAccountCredentials: SSHAccountCredentialsSchema.nullable().optional()
 });
 
-export const UpdateSSHResourceSchema = BaseUpdatePamResourceSchema.extend({
+export const UpdateSSHResourceSchema = BaseUpdateGatewayPamResourceSchema.extend({
   connectionDetails: SSHResourceConnectionDetailsSchema.optional(),
   rotationAccountCredentials: SSHAccountCredentialsSchema.nullable().optional()
 });

backend/src/ee/services/pam-session/pam-session-dal.ts

@@ -4,6 +4,8 @@ import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 
+import { PamSessionStatus } from "./pam-session-enums";
+
 export type TPamSessionDALFactory = ReturnType<typeof pamSessionDALFactory>;
 export const pamSessionDALFactory = (db: TDbClient) => {
   const orm = ormify(db, TableName.PamSession);
@@ -22,5 +24,19 @@ export const pamSessionDALFactory = (db: TDbClient) => {
     return session;
   };
 
-  return { ...orm, findById };
+  const expireSessionById = async (sessionId: string, tx?: Knex) => {
+    const now = new Date();
+
+    const updatedCount = await (tx || db)(TableName.PamSession)
+      .where("id", sessionId)
+      .whereIn("status", [PamSessionStatus.Active, PamSessionStatus.Starting])
+      .update({
+        status: PamSessionStatus.Ended,
+        endedAt: now
+      });
+
+    return updatedCount;
+  };
+
+  return { ...orm, findById, expireSessionById };
 };

backend/src/ee/services/pam-session/pam-session-enums.ts

@@ -1,6 +1,6 @@
 export enum PamSessionStatus {
   Starting = "starting", // Starting, user connecting to resource
   Active = "active", // Active, user is connected to resource
-  Ended = "ended", // Ended by user
+  Ended = "ended", // Ended by user or automatically expired after expiresAt timestamp
   Terminated = "terminated" // Terminated by an admin
 }

backend/src/ee/services/pam-session/pam-session-service.ts

@@ -34,9 +34,40 @@ export const pamSessionServiceFactory = ({
   licenseService,
   kmsService
 }: TPamSessionServiceFactoryDep) => {
+  // Helper to check and update expired sessions when viewing session details (redundancy for scheduled job)
+  // Only applies to non-gateway sessions (e.g., AWS IAM) - gateway sessions are managed by the gateway
+  // This is intentionally only called in getById (session details view), not in list
+  const checkAndExpireSessionIfNeeded = async <
+    T extends { id: string; status: string; expiresAt: Date | null; gatewayIdentityId?: string | null }
+  >(
+    session: T
+  ): Promise<T> => {
+    // Skip gateway-based sessions - they have their own lifecycle managed by the gateway
+    if (session.gatewayIdentityId) {
+      return session;
+    }
+
+    const isActive = session.status === PamSessionStatus.Active || session.status === PamSessionStatus.Starting;
+    const isExpired = session.expiresAt && new Date(session.expiresAt) <= new Date();
+
+    if (isActive && isExpired) {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+      const updatedSession = await pamSessionDAL.updateById(session.id, {
+        status: PamSessionStatus.Ended,
+        endedAt: new Date()
+      });
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+      return { ...session, ...updatedSession };
+    }
+
+    return session;
+  };
+
   const getById = async (sessionId: string, actor: OrgServiceActor) => {
-    const session = await pamSessionDAL.findById(sessionId);
-    if (!session) throw new NotFoundError({ message: `Session with ID '${sessionId}' not found` });
+    const sessionFromDb = await pamSessionDAL.findById(sessionId);
+    if (!sessionFromDb) throw new NotFoundError({ message: `Session with ID '${sessionId}' not found` });
+
+    const session = await checkAndExpireSessionIfNeeded(sessionFromDb);
 
     const { permission } = await permissionService.getProjectPermission({
       actor: actor.type,
@@ -116,7 +147,7 @@ export const pamSessionServiceFactory = ({
       OrgPermissionSubjects.Gateway
     );
 
-    if (session.gatewayIdentityId !== actor.id) {
+    if (session.gatewayIdentityId && session.gatewayIdentityId !== actor.id) {
       throw new ForbiddenRequestError({ message: "Identity does not have access to update logs for this session" });
     }
 
@@ -158,7 +189,7 @@ export const pamSessionServiceFactory = ({
         OrgPermissionSubjects.Gateway
       );
 
-      if (session.gatewayIdentityId !== actor.id) {
+      if (session.gatewayIdentityId && session.gatewayIdentityId !== actor.id) {
         throw new ForbiddenRequestError({ message: "Identity does not have access to end this session" });
       }
     } else if (actor.type === ActorType.USER) {

backend/src/lib/config/env.ts

@@ -286,6 +286,10 @@ const envSchema = z
     DYNAMIC_SECRET_AWS_SECRET_ACCESS_KEY: zpStr(z.string().optional()).default(
       process.env.INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY
     ),
+
+    // PAM AWS credentials (for AWS IAM PAM resource type)
+    PAM_AWS_ACCESS_KEY_ID: zpStr(z.string().optional()),
+    PAM_AWS_SECRET_ACCESS_KEY: zpStr(z.string().optional()),
     /* ----------------------------------------------------------------------------- */
 
     /* App Connections ----------------------------------------------------------------------------- */

backend/src/queue/queue-service.ts

@@ -83,6 +83,7 @@ export enum QueueName {
   HealthAlert = "health-alert",
   CertificateV3AutoRenewal = "certificate-v3-auto-renewal",
   PamAccountRotation = "pam-account-rotation",
+  PamSessionExpiration = "pam-session-expiration",
   PkiAcmeChallengeValidation = "pki-acme-challenge-validation"
 }
 
@@ -138,6 +139,7 @@ export enum QueueJobs {
   HealthAlert = "health-alert",
   CertificateV3DailyAutoRenewal = "certificate-v3-daily-auto-renewal",
   PamAccountRotation = "pam-account-rotation",
+  PamSessionExpiration = "pam-session-expiration",
   PkiAcmeChallengeValidation = "pki-acme-challenge-validation"
 }
 
@@ -404,6 +406,10 @@ export type TQueueJobTypes = {
     name: QueueJobs.PamAccountRotation;
     payload: undefined;
   };
+  [QueueName.PamSessionExpiration]: {
+    name: QueueJobs.PamSessionExpiration;
+    payload: { sessionId: string };
+  };
   [QueueName.PkiAcmeChallengeValidation]: {
     name: QueueJobs.PkiAcmeChallengeValidation;
     payload: { challengeId: string };

backend/src/server/routes/index.ts

@@ -290,6 +290,7 @@ import { orgServiceFactory } from "@app/services/org/org-service";
 import { orgAdminServiceFactory } from "@app/services/org-admin/org-admin-service";
 import { orgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 import { pamAccountRotationServiceFactory } from "@app/services/pam-account-rotation/pam-account-rotation-queue";
+import { pamSessionExpirationServiceFactory } from "@app/services/pam-session-expiration/pam-session-expiration-queue";
 import { dailyExpiringPkiItemAlertQueueServiceFactory } from "@app/services/pki-alert/expiring-pki-item-alert-queue";
 import { pkiAlertDALFactory } from "@app/services/pki-alert/pki-alert-dal";
 import { pkiAlertServiceFactory } from "@app/services/pki-alert/pki-alert-service";
@@ -2429,6 +2430,10 @@ export const registerRoutes = async (
   });
 
   const approvalPolicyDAL = approvalPolicyDALFactory(db);
+  const pamSessionExpirationService = pamSessionExpirationServiceFactory({
+    queueService,
+    pamSessionDAL
+  });
 
   const pamAccountService = pamAccountServiceFactory({
     pamAccountDAL,
@@ -2443,7 +2448,8 @@ export const registerRoutes = async (
     userDAL,
     auditLogService,
     approvalRequestGrantsDAL,
-    approvalPolicyDAL
+    approvalPolicyDAL,
+    pamSessionExpirationService
   });
 
   const pamAccountRotation = pamAccountRotationServiceFactory({
@@ -2531,6 +2537,7 @@ export const registerRoutes = async (
   await healthAlert.init();
   await pkiSyncCleanup.init();
   await pamAccountRotation.init();
+  await pamSessionExpirationService.init();
   await dailyReminderQueueService.startDailyRemindersJob();
   await dailyReminderQueueService.startSecretReminderMigrationJob();
   await dailyExpiringPkiItemAlert.startSendingAlerts();

backend/src/server/routes/sanitizedSchema/identitiy-additional-privilege.ts

@@ -2,6 +2,8 @@ import { IdentityProjectAdditionalPrivilegeSchema } from "@app/db/schemas";
 
 import { UnpackedPermissionSchema } from "./permission";
 
-export const SanitizedIdentityPrivilegeSchema = IdentityProjectAdditionalPrivilegeSchema.extend({
+export const SanitizedIdentityPrivilegeSchema = IdentityProjectAdditionalPrivilegeSchema.omit({
+  projectMembershipId: true
+}).extend({
   permissions: UnpackedPermissionSchema.array()
 });

backend/src/services/additional-privilege/additional-privilege-service.ts

@@ -79,7 +79,10 @@ export const additionalPrivilegeServiceFactory = ({
       });
 
       return {
-        additionalPrivilege: { ...additionalPrivilege, permissions: unpackPermissions(additionalPrivilege.permissions) }
+        additionalPrivilege: {
+          ...additionalPrivilege,
+          permissions: unpackPermissions(additionalPrivilege.permissions)
+        }
       };
     }
 
@@ -103,7 +106,10 @@ export const additionalPrivilegeServiceFactory = ({
     });
 
     return {
-      additionalPrivilege: { ...additionalPrivilege, permissions: unpackPermissions(additionalPrivilege.permissions) }
+      additionalPrivilege: {
+        ...additionalPrivilege,
+        permissions: unpackPermissions(additionalPrivilege.permissions)
+      }
     };
   };
 
@@ -136,7 +142,10 @@ export const additionalPrivilegeServiceFactory = ({
       });
 
       return {
-        additionalPrivilege: { ...additionalPrivilege, permissions: unpackPermissions(additionalPrivilege.permissions) }
+        additionalPrivilege: {
+          ...additionalPrivilege,
+          permissions: unpackPermissions(additionalPrivilege.permissions)
+        }
       };
     }
 
@@ -158,7 +167,10 @@ export const additionalPrivilegeServiceFactory = ({
     });
 
     return {
-      additionalPrivilege: { ...additionalPrivilege, permissions: unpackPermissions(additionalPrivilege.permissions) }
+      additionalPrivilege: {
+        ...additionalPrivilege,
+        permissions: unpackPermissions(additionalPrivilege.permissions)
+      }
     };
   };
 
@@ -179,7 +191,10 @@ export const additionalPrivilegeServiceFactory = ({
 
     const additionalPrivilege = await additionalPrivilegeDAL.deleteById(existingPrivilege.id);
     return {
-      additionalPrivilege: { ...additionalPrivilege, permissions: unpackPermissions(additionalPrivilege.permissions) }
+      additionalPrivilege: {
+        ...additionalPrivilege,
+        permissions: unpackPermissions(additionalPrivilege.permissions)
+      }
     };
   };
 
@@ -199,7 +214,10 @@ export const additionalPrivilegeServiceFactory = ({
       throw new NotFoundError({ message: `Additional privilege with id ${selector.id} doesn't exist` });
 
     return {
-      additionalPrivilege: { ...additionalPrivilege, permissions: unpackPermissions(additionalPrivilege.permissions) }
+      additionalPrivilege: {
+        ...additionalPrivilege,
+        permissions: unpackPermissions(additionalPrivilege.permissions)
+      }
     };
   };
 
@@ -219,7 +237,10 @@ export const additionalPrivilegeServiceFactory = ({
       throw new NotFoundError({ message: `Additional privilege with name ${selector.name} doesn't exist` });
 
     return {
-      additionalPrivilege: { ...additionalPrivilege, permissions: unpackPermissions(additionalPrivilege.permissions) }
+      additionalPrivilege: {
+        ...additionalPrivilege,
+        permissions: unpackPermissions(additionalPrivilege.permissions)
+      }
     };
   };
 

backend/src/services/pam-session-expiration/pam-session-expiration-queue.ts

@@ -0,0 +1,81 @@
+import { TPamSessionDALFactory } from "@app/ee/services/pam-session/pam-session-dal";
+import { getConfig } from "@app/lib/config/env";
+import { logger } from "@app/lib/logger";
+import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
+
+type TPamSessionExpirationServiceFactoryDep = {
+  queueService: TQueueServiceFactory;
+  pamSessionDAL: Pick<TPamSessionDALFactory, "expireSessionById">;
+};
+
+export type TPamSessionExpirationServiceFactory = ReturnType<typeof pamSessionExpirationServiceFactory>;
+
+export const pamSessionExpirationServiceFactory = ({
+  queueService,
+  pamSessionDAL
+}: TPamSessionExpirationServiceFactoryDep) => {
+  const appCfg = getConfig();
+
+  const init = async () => {
+    if (appCfg.isSecondaryInstance) {
+      return;
+    }
+
+    await queueService.startPg<QueueName.PamSessionExpiration>(
+      QueueJobs.PamSessionExpiration,
+      async (jobs) => {
+        await Promise.all(
+          jobs.map(async (job) => {
+            const { sessionId } = job.data;
+            try {
+              logger.info({ sessionId }, `${QueueName.PamSessionExpiration}: expiring session`);
+              const updated = await pamSessionDAL.expireSessionById(sessionId);
+              if (updated > 0) {
+                logger.info({ sessionId }, `${QueueName.PamSessionExpiration}: session expired successfully`);
+              } else {
+                logger.info(
+                  { sessionId },
+                  `${QueueName.PamSessionExpiration}: session not expired (already ended or not found)`
+                );
+              }
+            } catch (error) {
+              logger.error(error, `${QueueName.PamSessionExpiration}: failed to expire session ${sessionId}`);
+              throw error;
+            }
+          })
+        );
+      },
+      {
+        batchSize: 1,
+        workerCount: 1,
+        pollingIntervalSeconds: 30
+      }
+    );
+  };
+
+  // Schedule a session expiration job to run at the session's expiresAt time
+  const scheduleSessionExpiration = async (sessionId: string, expiresAt: Date) => {
+    const now = new Date();
+    const delayMs = Math.max(0, expiresAt.getTime() - now.getTime());
+    const startAfter = new Date(now.getTime() + delayMs);
+
+    await queueService.queuePg<QueueName.PamSessionExpiration>(
+      QueueJobs.PamSessionExpiration,
+      { sessionId },
+      {
+        startAfter,
+        singletonKey: `pam-session-expiration-${sessionId}`
+      }
+    );
+
+    logger.info(
+      { sessionId, expiresAt: expiresAt.toISOString(), scheduledFor: startAfter.toISOString() },
+      `${QueueName.PamSessionExpiration}: scheduled session expiration`
+    );
+  };
+
+  return {
+    init,
+    scheduleSessionExpiration
+  };
+};