# atmos aws cloudformation backend

Create, describe, update, delete, and list the S3 bucket referenced by a `kind:
aws/s3` `provision.targets` entry — the destination `apply`/`deploy` upload
oversized templates to when packaging is needed (see [Delivery
Targets](/stacks/components/aws-cloudformation#delivery-targets)). These verbs
manage that bucket directly, the same way `atmos terraform backend` manages a
Terraform component's state backend, targeting the identical registered S3
backend type — no separate backend kind exists for CloudFormation.

> ⚠️ Experimental

## Usage

```shell
atmos aws cloudformation backend create <component> --stack <stack>
atmos aws cloudformation backend describe <component> --stack <stack>
atmos aws cloudformation backend update <component> --stack <stack>
atmos aws cloudformation backend delete <component> --stack <stack> --force
atmos aws cloudformation backend list <component> --stack <stack>
```

Every verb takes the component as a required argument, and `--stack`. There is
no component-independent form, because the `kind: aws/s3` targets are declared
per component.

## Configuration

Declare a `kind: aws/s3` target under the component's `provision.targets`:

```yaml
components:
  "aws/cloudformation":
    vpc:
      provision:
        targets:
          artifacts:
            kind: aws/s3
            bucket: my-org-cfn-templates
            prefix: vpc
            region: us-east-1
```

See [Delivery Targets](/stacks/components/aws-cloudformation#delivery-targets)
for the full field reference, including how `apply`/`deploy` select and
package through this same target automatically when a template exceeds
CloudFormation's inline size limit.

## Target Resolution

Every `backend` verb resolves the `kind: aws/s3` target to operate on the same
way:

- **Exactly one `kind: aws/s3` target declared** — used automatically, no
  `--target` needed.
- **More than one declared** — `--target <name>` is required to disambiguate
  (`create`/`update`/`delete`/`describe`; `list` shows every declared target
  at once, so it never needs `--target`).
- **None declared** — `create`/`update`/`delete`/`describe` fail with a hint
  to add one.

## Dry Run

The `create`, `update`, and `delete` verbs honor `--dry-run`. They resolve the component
and its `kind: aws/s3` target from static configuration, print what they would
do (bucket and region), and make no AWS calls. A component or stack that does
not exist is an error, exactly as in a real run.

## Relationship to Automatic Provisioning

With `provision.backend.enabled: true`, only `apply` and `deploy` create the
bucket when packaging needs it. The `validate`, `diff`, and `changeset create`
verbs never create it; if the bucket is missing they fail with a hint to run
`backend create` or `apply`.

## Subcommands