AWS

To deploy on AWS, SKE needs an IAM role in your AWS account. SKE assumes this role to build container images, deploy Lambda functions, and provision infrastructure.

1. Create the IAM role

Create an IAM role in your AWS account with a trust policy that allows SKE’s platform account to assume it. The trust policy uses an External ID that SKE generates per connection — this prevents confused deputy attacks.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::PLATFORM_ACCOUNT_ID:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

The platform account ID and External ID are provided when you initiate the connection from the SKE dashboard or CLI.

2. Attach permissions

Attach an IAM policy that covers the SKE features you need. At minimum, you need permissions for compute (Lambda), container registry (ECR), infrastructure provisioning (CloudFormation), parameter storage (SSM), and logging (CloudWatch).

See the IAM Reference for the full list of permissions by feature group.

A minimal policy for deploying (without databases, caches, or networks):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:*",
        "lambda:*",
        "cloudformation:*",
        "ssm:*",
        "s3:*",
        "logs:*",
        "apigateway:*",
        "iam:PassRole",
        "iam:CreateRole",
        "iam:AttachRolePolicy",
        "iam:GetRole",
        "dynamodb:*",
        "secretsmanager:*"
      ],
      "Resource": "*"
    }
  ]
}

For databases, caches, and networking, add RDS, ElastiCache, and VPC permissions. For custom domains, add ACM and Route 53 permissions.

3. Connect the provider

ske provider:connect aws \
  --role-arn arn:aws:iam::123456789012:role/SKERole \
  --region us-east-1

SKE validates the role by assuming it and checking permissions for each feature group. The output shows which features passed and which need additional permissions.

What gets provisioned

When you deploy or create infrastructure, SKE provisions resources in your AWS account via CloudFormation:

Resource	AWS Service	Notes
Compute	Lambda	Container image functions, configurable memory and timeout
Container registry	ECR	One repository per project
API Gateway	API Gateway v2	HTTP API fronting Lambda
Queues	SQS	One queue per configured queue, with dead-letter queues
Scheduler	EventBridge	Rules for Laravel scheduled tasks
Parameters	SSM Parameter Store	Environment variables and secrets
State	DynamoDB	Deployment state tracking
Assets	S3 + CloudFront	Static file serving from public/
Logs	CloudWatch Logs	Structured application logs

When you provision additional infrastructure:

Resource	AWS Service
Database	RDS (MySQL, PostgreSQL, Aurora)
Cache	ElastiCache (Redis, Valkey)
Network	VPC, subnets, security groups, NAT gateway
Custom domain	ACM certificate + Route 53 DNS records
Secrets	Secrets Manager

Regions

SKE supports all standard AWS regions. Each environment pins its own region — you can run staging in eu-west-1 and production in us-east-1 using the same provider.

Security

• SKE uses sts:AssumeRole with an External ID — your credentials are never stored on the platform
• Session credentials expire after 15–60 minutes
• You control exactly which permissions the role has
• All actions are logged in AWS CloudTrail under the assumed role’s ARN