AWS

To deploy on AWS, SKE needs an IAM role in your AWS account. SKE assumes this role to build container images, deploy Lambda functions, and provision infrastructure.

1. Create the IAM role

Create an IAM role in your AWS account with a trust policy that allows SKE’s platform account to assume it. The trust policy uses an External ID that SKE generates for your workspace — this prevents confused deputy attacks.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::PLATFORM_ACCOUNT_ID:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

The connection wizard in the dashboard shows the trust policy with the platform account ID and External ID filled in.

2. Attach permissions

Attach an IAM policy that covers the SKE features you need. At minimum, you need permissions for compute (Lambda), container registry (ECR), infrastructure provisioning (CloudFormation), parameter storage (SSM), logs and metrics (CloudWatch).

See the IAM Reference for the full list of permissions by feature group.

A starter policy that passes SKE’s role check for every feature group, including databases, caches, networks, custom domains and email. SKE doesn’t pass CloudFormation a separate service role, so it also covers what CloudFormation creates for each environment: its queues, scheduler rules, CDN, execution role and log groups. For a narrower policy, grant only the groups you use from the IAM Reference.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:*",
        "lambda:*",
        "cloudformation:*",
        "ssm:*",
        "s3:*",
        "logs:*",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "apigateway:*",
        "sqs:*",
        "events:*",
        "cloudfront:*",
        "servicequotas:GetServiceQuota",
        "iam:SimulatePrincipalPolicy",
        "iam:PassRole",
        "iam:CreateRole",
        "iam:GetRole",
        "iam:DeleteRole",
        "iam:AttachRolePolicy",
        "iam:DetachRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:PutRolePolicy",
        "iam:GetRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:ListRolePolicies",
        "iam:TagRole",
        "iam:UntagRole",
        "dynamodb:*",
        "secretsmanager:*",
        "ec2:*",
        "rds:*",
        "elasticache:*",
        "acm:*",
        "route53:*",
        "ses:*",
        "sns:*"
      ],
      "Resource": "*"
    }
  ]
}

3. Connect the provider

In the dashboard, go to Connections, Cloud providers, select Connect provider and pick Amazon Web Services. The wizard shows the Boundary policy SkeExecutionBoundary, the Role policies (SkeAccess1, …) and the Trust policy, each with copy buttons, so you can create the role from them instead of the policy above (see Scoped policy). Enter the role’s ARN (arn:aws:iam::123456789012:role/SKERole) and a default region, then select Validate connection.

SKE validates the role by assuming it and checking permissions for each feature group. The wizard shows which features passed and which need additional permissions, plus any warnings (a missing SkeExecutionBoundary, a Lambda concurrency limit under 100), which don’t block Continue. Give the connection a name and select Save connection.

What gets provisioned

When you deploy or create infrastructure, SKE provisions resources in your AWS account via CloudFormation:

Resource	AWS Service	Notes
Compute	Lambda	Container image functions, configurable memory and timeout
Container registry	ECR	One repository per project
API Gateway	API Gateway v2	HTTP API fronting Lambda
Queues	SQS	One queue per configured queue, with dead-letter queues
Scheduler	EventBridge	Rules for Laravel scheduled tasks
Parameters	SSM Parameter Store	Environment variables and secrets
State	DynamoDB	Deployment state tracking
Assets	S3 + CloudFront	Static file serving from public/
Logs	CloudWatch Logs	Structured application logs

When you provision additional infrastructure:

Resource	AWS Service
Database	RDS (MySQL, PostgreSQL, Aurora)
Cache	ElastiCache (Redis, Valkey)
Network	VPC, subnets, security groups, NAT gateway
Custom domain	ACM certificate + Route 53 DNS records
Secrets	Secrets Manager

Regions

SKE supports all standard AWS regions. Each environment pins its own region — you can run staging in eu-west-1 and production in us-east-1 using the same provider.

Security

• SKE uses sts:AssumeRole with an External ID — your credentials are never stored on the platform
• Session credentials expire after 15–60 minutes
• You control exactly which permissions the role has
• All actions are logged in AWS CloudTrail under the assumed role’s ARN