Deploy role

Cross-account trust model

The Synthetiq platform triggers deployments through a two-hop IAM assume-role chain. This ensures that Synthetiq platform credentials never enter your account, your AWS credentials never enter the Synthetiq platform, and the deployment role has narrowly scoped permissions.

The role chain

Trigger an app deployment
  → Synthetiq API Backend
    → assumes SynthetiqDeployServiceRole (in Synthetiq's account)
      → assumes SynthetiqDeployRole (in your account)
        → starts deployment pipeline (in your account)

SynthetiqDeployRole permissions

The SynthetiqDeployRole is created in your account during provisioning. It is the only role the Synthetiq platform can assume, and its permissions are intentionally narrow:

Permission	Scope
Start deployments	Synthetiq deploy and teardown pipelines only
Monitor deployments	Execution status and build logs for Synthetiq pipelines only
Read stack outputs	Synthetiq infrastructure stacks only

The deploy role cannot access your application data, databases, secrets, or any resources outside the deployment pipeline. It can only trigger and monitor deployments.

Trust policy

The SynthetiqDeployRole trusts only the SynthetiqDeployServiceRole from Synthetiq’s account:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<SynthetiqDeployServiceRole ARN>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Platform Docs

Synthetiq Desktop

Synthetiq CLI

App Framework

Services Framework

Workflows Framework

Platform API

Deployments

Deploy role

Cross-account trust model

The role chain

SynthetiqDeployRole permissions

Trust policy

​Cross-account trust model

​The role chain

​SynthetiqDeployRole permissions

​Trust policy

Cross-account trust model

The role chain

SynthetiqDeployRole permissions

Trust policy