Skip to main content
All provisioning is driven by one file — _infra/synthetiq.yaml — committed to your git repository. generate and provision read it; changing your infrastructure means editing it and re-running the lifecycle.

​
Create it with infra init

From your infrastructure repository: 
synthetiq infra init \
  --domain apps.yourcompany.com \
  --profile <aws-profile>
init confirms the target AWS account, discovers your VPC, public subnets, and issued certificates, and writes the config with concrete ids: 
schema: v1
provider: aws
region: us-east-1
domain: apps.yourcompany.com
network:
  vpc: vpc-0abc123
  public_subnets: [subnet-aaa, subnet-bbb, subnet-ccc]
certs:
  api_cert_arn: arn:aws:acm:us-east-1:111122223333:certificate/aaaa…
  cdn_cert_arn: arn:aws:acm:us-east-1:111122223333:certificate/bbbb…
Commit it. generate and provision find the file from anywhere inside the repo.

​
Fields

Required — existing infrastructure Synthetiq references, never modifies:
FieldDescription
regionThe region Synthetiq provisions into
domainThe base domain apps are served under
network.vpcThe VPC Synthetiq lands in (in a fresh sub-account, init discovers the default VPC)
network.public_subnetsSubnets for the load balancer and NAT — at least 3 Availability Zones
certs.api_cert_arnIssued ACM ARN covering *.api.<domain>, in your region
certs.cdn_cert_arnIssued ACM ARN covering *.<domain> + apex, in us-east-1
Overrides — optional block listing existing infrastructure to reuse instead of letting the stack build it:
FieldWhen present
overrides.natWorkload egress routes through this NAT gateway; the stack doesn’t create one
overrides.private_subnetsWorkloads run in these subnets; the stack creates no networking. Cannot be combined with overrides.nat — see Networking
Anything not overridden is created and managed inside the Synthetiq stack, and appears as Add resources in the diff generate produces — so the effect of an omission is always visible before it’s applied. Unknown keys are rejected at load time, so a typo fails in CI instead of being silently ignored.

​
Authoring without AWS access

Run without credentials, init enters offline mode and asks for the values directly instead of discovering them. synthetiq infra generate validates every value against the real account later, wherever credentials exist (CI, or a teammate with a profile). The file is plain YAML — editing it by hand is equally valid. That’s also how you change infrastructure later: edit, commit, and re-run generate to see the diff before anything is applied.