Skip to main content
Config in git, plan on PR, apply on merge — no stored credentials, and the config author needs no AWS access. Each step links to the page with the details; full background: CI Integration.
Setting this up requires the org:service-accounts and org:trusts org scopes, plus your organization id. See Required Synthetiq permissions and check yours with synthetiq whoami.
1

Issue the two certificates

Request both ACM certs, add the 2 validation CNAMEs at your DNS provider, and wait for ISSUED. Note the two ARNs. See Certificates. (Validation can take a while — start it first.)
2

Create the GitHub repo

Create a private repo from SynthetiqAI/infra-template — it ships the workflow, a pinned @synthetiq/cli, the private-registry .npmrc, and an _infra/ skeleton:
Or use Use this template in the GitHub UI.Then add the SYNTHETIQ_NPM_KEY repo secret (Settings → Secrets and variables → Actions → Repository secrets).
3

Create the two AWS roles

In the target AWS account, create two roles trusting GitHub OIDC, each scoped to the repo you just created. Replace <github-org>/<repo> with it — e.g. acme/synthetiq-infra:
  • plan — trusts repo:<github-org>/<repo>:pull_request; policy from synthetiq infra permissions --stage generate
  • apply — trusts repo:<github-org>/<repo>:ref:refs/heads/main; policy from synthetiq infra permissions --stage provision
Note both role ARNs — you’ll add them to the workflow when you set up the repo locally.
4

Create the Synthetiq service account

Find the role id for CI Provision Apply:
Create the service account with that role (e.g. name it CI Provisioner):
Create the OIDC trust so CI can authenticate as it — use the same repo as the apply role:
See Service Account.
5

Set up the repo locally

Clone the repo:
Install the pinned CLI (this also generates the lockfile CI installs from):
Fill the three values in .github/workflows/synthetiq-infra.yml — the two role ARNs (use the ARNs you noted from the roles step; <your-aws-account-id> is your 12-digit account number) and your org id:
See CI Integration for the full workflow it wraps.
To nest package.json, .npmrc, and _infra/ under a subdirectory (e.g. partner/synthetiq/) instead of the repo root — useful inside a shared infrastructure monorepo — move them there together, add working-directory: partner/synthetiq to the workflow’s with: block, and prefix the trigger paths: with the same directory. Run the npm install and synthetiq infra commands in the following steps from inside that directory, and adjust the git add paths to match. See Nested directory layout.
6

Author the config and open the PR

On a branch, generate the config:
With no AWS credentials, init runs in offline mode: enter your VPC and public subnet ids and the two certificate ARNs. See Generating synthetiq.yaml.Commit the workflow edit, the lockfile, and the config together, then push and open the PR:
The pull request CI job runs against the real account and posts the proposed CloudFormation diff plus a summary of the proposed changeset as a PR comment.
7

Review & merge

Review the diff, then merge. On merge the CI applies the changeset on the target AWS account. The job log ends with the 3 app DNS records that you will need to configure to finalize the provisioning — this is a one-time setup, only needed on the initial provisioning (unless you later change the domain configuration for Synthetiq apps). See DNS setup for more details.
To update later: edit the config — or let a dependency bot like Renovate or Dependabot open the version-bump PR — and the same PR → review → merge loop applies it.