> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy role

> Cross-account trust model and deploy role permissions for BYOI deployments

The Synthetiq platform triggers deployments in your account through a cross-account IAM role. This page describes the trust model and the role's permissions.

## Cross-account trust model

The Synthetiq platform triggers deployments through a two-hop IAM assume-role chain. This ensures that Synthetiq platform credentials never enter your account, your AWS credentials never enter the Synthetiq platform, and the deployment role has narrowly scoped permissions.

### The role chain

```
Trigger an app deployment
  → Synthetiq API Backend
    → assumes SynthetiqDeployServiceRole (in Synthetiq's account)
      → assumes SynthetiqDeployRole (in your account)
        → starts deployment pipeline (in your account)
```

### SynthetiqDeployRole permissions

The `SynthetiqDeployRole` is created in your account during [provisioning](/docs/platform-docs/deployments/byoi/provisioning). It is the only role the Synthetiq platform can assume, and its permissions are intentionally narrow:

| Permission          | Scope                                                        |
| ------------------- | ------------------------------------------------------------ |
| Start deployments   | Synthetiq deploy and teardown pipelines only                 |
| Monitor deployments | Execution status and build logs for Synthetiq pipelines only |
| Read stack outputs  | Synthetiq infrastructure stacks only                         |

<Note>
  The deploy role cannot access your application data, databases, secrets, or any resources outside the deployment pipeline. It can only trigger and monitor deployments.
</Note>

### Trust policy

The `SynthetiqDeployRole` trusts only the `SynthetiqDeployServiceRole` from Synthetiq's account:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<SynthetiqDeployServiceRole ARN>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```