Docs / Cloud accounts
What SysJ can access
How SysJ’s access to your account is scoped, and what it stores.
| Question | Answer |
|---|---|
| Does SysJ store a key to my cloud? | No. It assumes your role for each run. |
| What does SysJ store? | The account id, the role it assumes, the external id, and the names of the state bucket and lock table. |
| What will SysJ change? | The resources in the Terraform for clusters it built. Everything else in the account is outside its state. |
| Where does Terraform state live? | In the S3 bucket the stack created in your account, encrypted with S3-managed keys. |
| How do I revoke access? | Delete the CloudFormation stack. You do not need to ask us. |
Each run is isolated
Every plan, apply and teardown runs as its own workflow, with one workspace’s role, and the session it assumes ends with the run.