AWS. GitHub. Terraform. OIDC.

Your shared deployment roles are a liability.

We allow engineers to centrally manage what is deployed to where, using least-privilege just-in-time AWS IAM roles.

See how

The problem

Shared power user roles are a compromise everyone accepts until something goes wrong

Maintaining a deployment role for each repository is tedious work, especially at scale. Teams often reuse a handful of powerful roles across their repositories and accept the risk of wider blast radiuses, a lack of least privilege, and a lack of auditability.

Our purpose

Reduce risk, improve auditability, and make it easy to manage.

Synky generates least-privilege deployment roles just-in-time during GitHub Actions deployments, based on the Terraform being deployed. The roles are short-lived and are automatically revoked after the deployment completes, meaning there is no risk of a power user role being misused and per-deployment auditability is maintained.

How it works

The five stages of Synky

Map repos to accounts, gate IAM changes, deploy with short-lived roles, and keep an audit trail, without standing power user roles in every account.

  1. Centrally manage your repo-to-account map

    Bind repositories, branches, and environments to the AWS accounts they deploy to. Set least-privilege defaults and whether IAM changes need approval. Build the map in the UI or declaratively with YAML, so platform never loses track of which repo can reach which account, via which role.

    Synky map management table showing repository to account bindings

  2. Assign your approvers

    Organise teams with members and designated approvers. Attach repositories so ownership stays clear as the org grows. Approvers review proposed trust and permission changes before they land in AWS. Security gets a gate without becoming the IAM ticket queue.

    Synky team management showing teams, members, and linked repositories

  3. Deploy and review

    During the deploy phase in GitHub Actions, Synky analyses your Terraform and proposes deployment-role permission updates to match what the run actually needs. Nothing applies until you approve. Gate by environment, path, branch, or repo so material IAM diffs pause for an authorised reviewer.

    Synky dashboard showing pending reviews and repository metrics

  4. Roles deployed Just-In-Time

    At deploy time Synky sets up a short-lived deployer role, runs the plan, attaches the scoped permissions the run needs, then applies. When the job finishes, the elevated access is cleaned up. No shared power-user roles sitting in the account between deploys.

    Deploy workflow: Setup Deployer Role, Plan Prod, Assign Role Permissions, Apply Prod

  5. Track everything in one place

    The activity feed records triggers, syncs, JIT grants, and review decisions: what changed, who approved it, and when. When audit asks who touched deployment access, the answer is already in one place instead of a spreadsheet hunt.

    Synky activity feed showing sync and review events

The benefits summed up

Key benefits

Minimal blast radius

Synky links a single role to a single deployment, with permissions tailored specifically to the resources being read, created, updated or deleted. No other GitHub organisation, repository or team may assume the role.

Approval gates

Synky can gate approvals at three points. Firstly, when any changes to the Repository Map affecting a repository to account binding are triggered. Then, after any Apply or Destroy. Each gate can be independently controlled for any binding.

One map for every deploy

A centralised Repository Map allows engineers to control which path, branch, tag or environment within a repository is deployed to which AWS account, plus when approvals are required. Group repositories together and point them at the same account, or use a single account per repository, the map is flexible yet specific.

Audit by default

We track events from two perspectives; all changes within the UI are tracked and uniquely attributable, and all management actions performed by the deployment roles are captured and can be linked to a single deployment. All logs can be exported to easily supply to auditors.

Harry Carr

About the founder

Harry Carr

Security Engineering Manager by day
Founder of Synky by night

I've spent over 10 years building and maintaining systems using an assortment of tools including Terraform, AWS and GitHub. Most recently I've been leading a team of security engineers, designing, developing and maintaining controls to protect data within our organisation's banking environment.

Identity and Access Management is a constant challege, so I'm building Synky to solve at least one part of the IAM puzzle.

FAQ

What you want to know

What access does Synky need to my AWS account?
We need very limited access. Synky requires access to create and manage OIDC configurations, specifically named IAM roles, their trust and permission policies, plus general read-only IAM capabilities. Access is ARN-prefix scoped so Synky cannot create arbitrarily named roles or modify the bootstrap role itself. The exact permissions we need can be found .
We already use OIDC, why do we need Synky?
OIDC is only part of the puzzle. Synky handles the roles your repositories assume using OIDC, ensures the role’s permissions are least-privilege and allows you to easily see exactly what actions were performed within your accounts.
How do we integrate with Synky?
Synky is a SaaS which gives you a centralised UI to manage your repository map, users and approvers, and all our other settings. When you’re ready to deploy, incorporate two small GitHub actions into your workflows and let Synky do the rest.
How do you know what permissions the deployment role needs?
At deploy time, we analyse both the HCL and the Terraform plan output, we correlate this with our internal permissions map and determine the permissions required. We can tightly scope the permissions or leave them open, you can control this per branch, environment, tag or path.
I joined the wait list, what now?
We’ll reach out to you to understand your use case and potentially provide you with pre-live access. Synky isn’t ready for a public live release just yet, but we’re looking to partner with teams to understand how we can develop the product specifically for your circumstances.