Security · 5 min read
Connecting an AWS account
How SysJ reaches your AWS account without a stored key, what the role allows, and how to revoke it.
What you create
From the Cloud accounts screen, SysJ generates a CloudFormation template for your account. Running it creates one IAM role that trusts SysJ’s platform account, conditioned on an external id that is unique to your workspace.
The external id prevents another SysJ customer from pointing SysJ at your account, which is the confused-deputy problem the condition exists to solve.
- Open Cloud accounts and choose Connect AWS account.
- Launch the generated stack in your AWS console.
- Paste the role ARN the stack outputs back into SysJ.
- SysJ verifies the connection by assuming the role once.
What SysJ stores
The role ARN and the external id. No access key, no secret key and no session token outlive the run that used them.
"Condition": {
"StringEquals": {
"sts:ExternalId": "<your workspace external id>"
}
}What it can touch
SysJ tags everything it creates and scopes its changes to resources carrying that tag. Resources you created yourself are not modified unless you import them into SysJ.
Revoking access
Delete the CloudFormation stack. The role disappears and SysJ can no longer reach the account. Your infrastructure, your Terraform state and your repository are unaffected.