> ## Documentation Index
> Fetch the complete documentation index at: https://synthetiq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Prerequisites

> What you need before provisioning Synthetiq in your AWS account

Synthetiq BYOI provisioning is declarative: you describe the desired state in a config file (`_infra/synthetiq.yaml`), **generate** a plan showing exactly what will change, and **provision** to apply it.

## What you need

* **Two issued ACM certificates** for the domain. See [Certificates](/docs/platform-docs/deployments/byoi/certificates).
* **A domain you control** — every app gets a subdomain under it (e.g. `my-app.apps.yourcompany.com`). See [DNS](/docs/platform-docs/deployments/byoi/dns) for the records you'll create.
* **The Synthetiq CLI** — installed from the private npm registry. See [Installation](/docs/platform-docs/cli/overview#installation).
* **A Synthetiq service account** for provisioning from CI (local runs use your own login). See [Service Account](/docs/platform-docs/deployments/byoi/service-account).
* **An AWS account with appropriate permissions** — a dedicated sub-account is recommended; see [Networking](/docs/platform-docs/deployments/byoi/networking) and [Permissions](/docs/platform-docs/deployments/byoi/permissions).
* **A git repository** for the Synthetiq infrastructure configuration.
* **The right Synthetiq org permissions** on your account — see below.

## Required Synthetiq permissions

Which org scopes you need depends on how you provision:

| Flow                 | Scopes the person needs              | Why                                                                                                                                                                                                                                                                        |
| -------------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **CI** (recommended) | `org:service-accounts`, `org:trusts` | To create the CI service account (`synthetiq service-account create`) and its OIDC trust (`synthetiq trust create`). The service account runs the provision using the built-in **CI Apply** role, which already carries `infra:provision` — so no person needs that scope. |
| **Local machine**    | `infra:provision`                    | You run `synthetiq infra provision` yourself, so your own role must carry the scope the provisioning callback requires. (No service account or trust needed.)                                                                                                              |

Check what your current role grants:

```bash theme={null}
synthetiq whoami
```

The `Scopes:` list shows your effective org scopes. If any are missing, ask an organization **Admin** to grant them via a role (Admins have all scopes).

## Finding your organization id

Several steps need your organization id — the CI workflow's `organization-id` input and the OIDC token exchange. Get it from either:

* **Console** — **Settings → Account**, the **Organization ID** row (with a copy button).
* **CLI** — `synthetiq whoami` prints `Org ID:`.

## The lifecycle at a glance

| Step         | Command                     | What it does                                                             |
| ------------ | --------------------------- | ------------------------------------------------------------------------ |
| 1. Configure | `synthetiq infra init`      | Interview → writes `_infra/synthetiq.yaml`                               |
| 2. Preview   | `synthetiq infra generate`  | Computes a CloudFormation change set; writes a reviewable changeset file |
| 3. Apply     | `synthetiq infra provision` | Executes exactly the reviewed change set                                 |

For production, steps 2 and 3 run from CI — see [CI Integration](/docs/platform-docs/deployments/byoi/ci-integration). For the full order of operations, follow a walkthrough: [Local Machine](/docs/platform-docs/deployments/byoi/walkthroughs/local-machine) or [CI](/docs/platform-docs/deployments/byoi/walkthroughs/ci).