> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Infra commands

> Provision and manage BYOI infrastructure: init, generate, provision

Manage [Bring Your Own Infrastructure](/docs/platform-docs/deployments/byoi/overview) provisioning. The lifecycle is `init` (write the config) → `generate` (preview the change) → `provision` (apply it) — see the [walkthroughs](/docs/platform-docs/deployments/byoi/walkthroughs/local-machine) for the full setup.

## init

Interactive wizard — writes the infrastructure config (`_infra/synthetiq.yaml`):

```bash theme={null}
synthetiq infra init \
  --domain apps.yourcompany.com \
  --profile <aws-profile>
```

With AWS credentials, init discovers your VPC, subnets, and issued certificates and writes concrete ids. Without credentials it runs in offline mode and prompts for the values.

All flags are optional — they pre-answer the wizard's prompts. With `--yes` (non-interactive) there are no prompts, so `--domain` is required and the certificates must be discoverable in the account or passed via `--api-cert-arn` / `--cdn-cert-arn`.

| Flag                         | Description                                                |
| ---------------------------- | ---------------------------------------------------------- |
| `--domain <domain>`          | Base domain for apps (e.g. `apps.yourcompany.com`)         |
| `--region <region>`          | AWS region for the infrastructure (default: `us-east-1`)   |
| `--profile <profile>`        | AWS profile to use (default: environment credential chain) |
| `--config <path>`            | Config file to write (default: `_infra/synthetiq.yaml`)    |
| `--force`                    | Overwrite an existing config file                          |
| `--vpc-id <id>`              | Use a specific VPC (default: discover)                     |
| `--subnet-ids <ids>`         | Comma-separated public subnet ids (≥ 3 AZs)                |
| `--nat-gateway-id <id>`      | Reuse an existing NAT gateway                              |
| `--private-subnet-ids <ids>` | Comma-separated existing private subnet ids                |
| `--api-cert-arn <arn>`       | Issued ACM certificate for `*.api.<domain>`                |
| `--cdn-cert-arn <arn>`       | Issued ACM certificate for `*.<domain>` (us-east-1)        |
| `--yes`                      | Accept defaults without prompting                          |

## generate

Compute the CloudFormation change sets from the config and write a reviewable changeset file — nothing is executed:

```bash theme={null}
synthetiq infra generate \
  --profile <aws-profile>
```

Exit codes match `terraform plan -detailed-exitcode`: `0` when nothing changed, `2` when changes are pending, `1` on error.

| Flag                  | Description                                                                      |
| --------------------- | -------------------------------------------------------------------------------- |
| `--config <path>`     | Config file to read (default: nearest `_infra/synthetiq.yaml`, searching upward) |
| `--out <dir>`         | Directory for changeset files (default: `changesets/` next to the config)        |
| `--profile <profile>` | AWS profile to use (default: environment credential chain)                       |

## provision

Apply the pending changeset — executes exactly the reviewed change sets, prints the app [DNS records](/docs/platform-docs/deployments/byoi/dns), seeds the deploy key, and registers the account as your organization's deployment target:

```bash theme={null}
synthetiq infra provision \
  --profile <aws-profile>
```

Requires a Synthetiq identity holding the `infra:provision` scope (your login locally, a [service account](/docs/platform-docs/deployments/byoi/service-account) in CI) — `init` and `generate` need no Synthetiq identity at all. Refuses to apply when the config changed since `generate`, when the stack moved underneath the change set, or when the changeset was generated by a different CLI version.

| Flag                     | Description                                                                                  |
| ------------------------ | -------------------------------------------------------------------------------------------- |
| `--config <path>`        | Config file to validate against (default: nearest `_infra/synthetiq.yaml`, searching upward) |
| `--changeset <path>`     | Changeset file (default: latest in `changesets/` next to the config)                         |
| `--changesets-dir <dir>` | Directory holding changeset files                                                            |
| `--profile <profile>`    | AWS profile to use (default: environment credential chain)                                   |
| `--skip-preflight`       | Skip the IAM permission simulation                                                           |
| `--allow-version-skew`   | Proceed even if this CLI version differs from the one that generated the changeset           |
| `--yes`                  | Skip confirmation                                                                            |

## status

Show your organization's registered deployment target — the result of the most recent `provision`:

```bash theme={null}
synthetiq infra status
```

Reports the registration `status` (`ready`, `provisioning`, `failed`, …) along with the AWS account, domain, and deploy role. Prints `No deployment target registered` when the organization has never provisioned.

| Flag     | Description                          |
| -------- | ------------------------------------ |
| `--json` | Output the raw configuration as JSON |

## permissions

Print the IAM policy required for provisioning (JSON):

```bash theme={null}
synthetiq infra permissions \
  --stage generate
```

| Flag              | Description                                                                                                  |
| ----------------- | ------------------------------------------------------------------------------------------------------------ |
| `--stage <stage>` | Print only what one stage needs: `init`, `generate`, or `provision` (default: `provision` — the full policy) |

See [Permissions](/docs/platform-docs/deployments/byoi/permissions) for what each stage's policy contains.