Infra commands

Manage Bring Your Own Infrastructure provisioning. The lifecycle is init (write the config) → generate (preview the change) → provision (apply it) — see the walkthroughs for the full setup.

init

Interactive wizard — writes the infrastructure config (_infra/synthetiq.yaml):

synthetiq infra init \
  --domain apps.yourcompany.com \
  --profile <aws-profile>

With AWS credentials, init discovers your VPC, subnets, and issued certificates and writes concrete ids. Without credentials it runs in offline mode and prompts for the values. All flags are optional — they pre-answer the wizard’s prompts. With --yes (non-interactive) there are no prompts, so --domain is required and the certificates must be discoverable in the account or passed via --api-cert-arn / --cdn-cert-arn.

Flag	Description
`--domain <domain>`	Base domain for apps (e.g. `apps.yourcompany.com`)
`--region <region>`	AWS region for the infrastructure (default: `us-east-1`)
`--profile <profile>`	AWS profile to use (default: environment credential chain)
`--config <path>`	Config file to write (default: `_infra/synthetiq.yaml`)
`--force`	Overwrite an existing config file
`--vpc-id <id>`	Use a specific VPC (default: discover)
`--subnet-ids <ids>`	Comma-separated public subnet ids (≥ 3 AZs)
`--nat-gateway-id <id>`	Reuse an existing NAT gateway
`--private-subnet-ids <ids>`	Comma-separated existing private subnet ids
`--api-cert-arn <arn>`	Issued ACM certificate for `.api.<domain>` (optionally also listing `.s1.api.<domain>` through `*.s9.api.<domain>`; see Certificates)
`--cdn-cert-arn <arn>`	Issued ACM certificate for `*.<domain>` (us-east-1)
`--yes`	Accept defaults without prompting

generate

Compute the CloudFormation change sets from the config and write a reviewable changeset file — nothing is executed:

synthetiq infra generate \
  --profile <aws-profile>

Exit codes match terraform plan -detailed-exitcode: 0 when nothing changed, 2 when changes are pending, 1 on error.

Flag	Description
`--config <path>`	Config file to read (default: nearest `_infra/synthetiq.yaml`, searching upward)
`--out <dir>`	Directory for changeset files (default: `changesets/` next to the config)
`--profile <profile>`	AWS profile to use (default: environment credential chain)

provision

Apply the pending changeset — executes exactly the reviewed change sets, prints the app DNS records (including one per load balancer shard), seeds the deploy key, and registers the account as your organization’s deployment target:

synthetiq infra provision \
  --profile <aws-profile>

Requires a Synthetiq identity holding the infra:provision scope (your login locally, a service account in CI) — init and generate need no Synthetiq identity at all. Refuses to apply when the config changed since generate, when the stack moved underneath the change set, or when the changeset was generated by a different CLI version.

Flag	Description
`--config <path>`	Config file to validate against (default: nearest `_infra/synthetiq.yaml`, searching upward)
`--changeset <path>`	Changeset file (default: latest in `changesets/` next to the config)
`--changesets-dir <dir>`	Directory holding changeset files
`--profile <profile>`	AWS profile to use (default: environment credential chain)
`--skip-preflight`	Skip the IAM permission simulation
`--allow-version-skew`	Proceed even if this CLI version differs from the one that generated the changeset
`--yes`	Skip confirmation

status

Show your organization’s registered deployment target — the result of the most recent provision — and its load balancer capacity:

synthetiq infra status \
  --profile <aws-profile>

Reports the registration status (ready, provisioning, failed, …) along with the AWS account, domain, and deploy role. Prints No deployment target registered when the organization has never provisioned. When run inside an infra repo with AWS credentials for the registered account, it also lists each load balancer shard with its app count (out of 100), flags shards whose DNS record doesn’t point at them yet, and warns once every shard holds more than 80 apps. Without credentials it skips that section.

Flag	Description
`--json`	Output the raw configuration as JSON (no capacity section)
`--config <path>`	Infra config for the capacity report (default: nearest `_infra/synthetiq.yaml`, searching upward)
`--profile <profile>`	AWS profile for the capacity report (default: environment credential chain)

permissions

Print the IAM policy required for provisioning (JSON):

synthetiq infra permissions \
  --stage generate

Flag	Description
`--stage <stage>`	Print only what one stage needs: `init`, `generate`, or `provision` (default: `provision` — the full policy)

See Permissions for what each stage’s policy contains.

Platform Docs

Synthetiq Desktop

Synthetiq CLI

App Framework

Services Framework

Workflows Framework

Platform API

Deployments

init

generate

provision

status

permissions

​init

​generate

​provision

​status

​permissions

init

generate

provision

status

permissions