Docs / Cloud accounts

Connect AWS

Grant SysJ an IAM role in your account through a CloudFormation stack, limited by an external id unique to your workspace.

SysJ never stores an AWS access key. You create a role that trusts SysJ’s platform account, and SysJ assumes it for each plan, build and teardown.

Connect the account

  1. Open Cloud accounts and choose Connect a cloud account.
  2. Choose AWS, give the account a name your team will recognise (Production, Sandbox), and enter its twelve-digit account id.
  3. SysJ shows the CloudFormation template in full. Read it: it is exactly what SysJ will be allowed to do.
  4. Choose the button that opens the template in your AWS console, with the values filled in, and create the stack.
  5. Back in SysJ, choose Check that it worked. SysJ assumes the role there and then, and marks the account connected only if that succeeds.

What the stack creates

ResourceWhy
IAM roleThe identity SysJ assumes. It trusts SysJ only with your external id.
S3 bucketTerraform state for your clusters, encrypted at rest (SSE-S3).
DynamoDB tableThe Terraform state lock, so two runs never write state at once.

The trust condition

The role trusts SysJ only when the request carries your workspace’s external id. That stops another SysJ customer from pointing SysJ at your account.

Trust policy condition
"Condition": {
  "StringEquals": {
    "sts:ExternalId": "<your workspace external id>"
  }
}

If the check fails

The account stays unverified and the reason is shown on its row. The usual causes are a stack still being created, a stack created in a different account, or the external id edited by hand. Fix it and choose Check again.

Revoke access

Choose Stop using this account in SysJ, then delete the CloudFormation stack in AWS. Deleting the stack removes the role, so SysJ can no longer reach the account. Tear down any clusters first if you want SysJ to remove them for you.

PreviousCore conceptsNextCluster access for your team