Role-Based Access

Role-based access uses AWS IAM roles to grant Synqly temporary credentials to access resources in your AWS account. This eliminates long-lived credentials and provides better security through the principle of least privilege.

1. Create an IAM Role

Create a role in your AWS account with a name that starts with SynqlyAccess (for example, SynqlyAccessS3Reader). This naming convention is required.

1. In the AWS IAM console, go to Roles and choose Create role.
2. For trusted entity type, choose Custom trust policy.
3. Enter the following trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::733459310821:role/SynqlyIntegrationAccess"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

Replace YOUR_EXTERNAL_ID with a unique identifier you generate (for example, a UUID). You will provide this External ID when configuring the integration.

4. Name the role with a SynqlyAccess prefix (for example, SynqlyAccessMyIntegration).
5. Attach the appropriate permissions policy for your use case.
6. Create the role and note its ARN.

For more details, see:

• Access to AWS accounts owned by third parties
• Create a role using custom trust policies

External ID Requirements

The External ID is a security mechanism that prevents the confused deputy problem. It ensures that only authorized requests from Synqly can assume your role.

The External ID must contain only the following characters:

• Alphanumeric characters (a-z, A-Z, 0-9)
• Special characters: + = , . @ : / -
• Must be between 2 and 1224 characters in length

Configuring the Integration Credentials

When creating an AWS integration in Synqly, provide the following configuration values based on your chosen authentication method.