--- title: "How to perform Just-In-Time (JIT) dynamic secrets provisioning" slug: "how-to-manage-the-dynamic-just-in-time-jit-secret-provisioning" updated: 2026-05-06T12:15:27Z published: 2026-05-06T12:15:27Z canonical: "docs.senhasegura.io/how-to-manage-the-dynamic-just-in-time-jit-secret-provisioning" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt > Use this file to discover all available pages before exploring further. # How to perform Just-In-Time (JIT) dynamic secrets provisioning To ensure a high level of security in elastic cloud environments, the **DevOps Secret Manager (DSM)** enables automatic provisioning and deprovisioning of JIT secrets across cloud providers, environments, and systems. This scenario is commonly used in ephemeral and dynamic environments where JIT secrets are created. More information in [About dynamic provisioning](/v4-2/docs/dsm-about-dynamic-provisioning) and [About dynamic provisioning profiles](/v4-2/docs/cloud-iam-dynamic-provisioning-profiles). ## Requirements - Access to **DevOps Secret Manager**. - For dynamic credential provisioning: **PAM Core**. - For cloud environment provisioning: **Cloud IAM**. ## Step 1: Configure the dynamic provisioning profile The first step is to configure the dynamic provisioning profile. Dynamic provisioning profiles are pre-configured definitions that allow **DSM** to automate the creation and management of access credentials. ### Configure a dynamic access key provisioning profile for cloud providers To configure the dynamic JIT secrets provisioning profile for cloud providers, see the following steps: 1. On **Segura® Platform**, hover over the **Products menu** in the navigation bar and select **Cloud IAM**. 2. In the side menu, select **Identity management > Dynamic provisioning**, then click **Profiles**. 3. In the **Profiles** report, click **Add**. 4. Select the cloud account where you want to configure dynamic provisioning. 5. In the **Settings** tab, fill in the following fields: 6. In the **Identifier *** field, enter a name for the profile. 7. In the **Enabled *** field, choose whether to activate or deactivate the profile. 8. Optional: In the **Description** field, provide a description of the profile. 9. Click **Continue**. 10. In the **Review** tab, verify the information entered in the previous tab and click **Save**. After configuring and creating the dynamic access key provisioning profile, proceed to [Step 2: Create the application](/v4-2/docs/how-to-manage-the-dynamic-just-in-time-jit-secret-provisioning#step-2-create-the-application). ### Configure a dynamic credential provisioning profile **DSM** supports dynamic provisioning credentials in various systems and devices, such as databases (MySQL, Oracle, and SQL Server), Linux and Windows servers, and other technologies. To configure a dynamic credential provisioning profile, see the following steps: 1. On **Segura® Platform**, hover over the **Products menu** in the navigation bar and select **PAM Core**. 2. In the side menu, select **Management > Dynamic credentials**, then click **Profiles**. 3. In the **Profiles** report, click **Add**. 4. In the **Identifier *** field, enter a name for the profile. 5. In the **Status *** field, choose whether to activate or deactivate the profile. 6. In the **Type *** field, select the type of device. 7. Optional: In the **Use a registered credential to access all devices** field, select to use a specific credential to access all devices.. 8. Optional: In the **Access credential registered in the system** field, choose which credential to use. This field will only be available if the **Use a registered credential to access all devices** checkbox is enabled. 9. Optional: In the **Credential username** field, enter the credential username. 10. In the **Credential creation template *** field, select the template for creating credentials. More information in [Executions templates](/v4-2/docs/executions-executions-templates). 11. In the **Credential removal template *** field, select the template for removing credentials. More information in [Executions templates](/v4-2/docs/executions-executions-templates). 12. Optional: In the **Roles** field, add roles or groups to be assigned to the user. 13. Optional: In the **Seconds** field, define how long the credential should be valid. After this period, the **Segura® Platform** will automatically delete the credential from the target device. After configuring and creating the dynamic credential profile, proceed to [Step 2: Create the application](/v4-2/docs/how-to-manage-the-dynamic-just-in-time-jit-secret-provisioning#step-2-create-the-application). ## Step 2: Create the application Once you’ve created the necessary dynamic provisioning profiles, an application must be created and assigned those profiles. To create an application, see the following steps: 1. On the **Segura® Platform**, hover over the **Products menu** in the navigation bar and select **DevOps Secret Manager**. 2. In the side menu, select **Application management > Applications**. 3. In the **Applications** report, click **Add**. 4. In the **Settings** tab, enter the following information: 1. In the **Application name *** field, enter a name for the application. 2. In the **Authentication method *** field, select the desired authentication method. 3. In the **Line of business** field, select the relevant line of business. 4. In the **Application type** field, choose the type of application being registered. 5. In the **Status** ***** field, set the application’s current state. 6. In the **Tags** field, enter any tags, separated by commas. 7. In the **Description** field, provide a description for the application. 8. In the **Amazon AWS ARNs** field, click **+ Add** and enter the ARN(s) of the resource(s) to be registered. 9. Click **Continue**. 5. In the **Automatic provisioning** tab, enter the following information: 1. In the **Automatic provisioning of secrets** field, enable the application provisioning. 2. In the **Cloud dynamic provisioning profile** table, click **+ Add** and select the cloud access key profile you configured earlier in the [Configure a dynamic access key provisioning profile for cloud providers](/v4-2/docs/how-to-manage-the-dynamic-just-in-time-jit-secret-provisioning#configure-a-dynamic-access-key-provisioning-profile-for-cloud-providers) section. 3. In the **Credential dynamic provisioning profile** table, click **+ Add** and select the credential profile you configured earlier in the [Configure a dynamic credential provisioning profile](/v4-2/docs/how-to-manage-the-dynamic-just-in-time-jit-secret-provisioning#configure-a-dynamic-credential-provisioning-profile) section. 4. Click **Continue**. 6. In the **Review** tab, review all information entered previously and click **Save**. After creating the application and assigning the configured profiles, the automatic JIT secrets provisioning and deprovisioning across cloud providers, environments, and systems will be active.