# atmos aws cloudformation backend create

Create or update the S3 bucket referenced by the component's resolved `kind:
  aws/s3` provision target, applying secure defaults: versioning enabled,
AES-256 encryption, and all four public-access-block settings enabled. If
the bucket already exists, its settings are brought in line with these
defaults after you confirm the change. The operation is idempotent, but
prompts again when the bucket already exists; use `--auto-approve` to
skip this confirmation in automation.

> ⚠️ Experimental

## Usage

```shell
atmos aws cloudformation backend create <component> --stack <stack> [options]
```

```shell
atmos aws cloudformation backend create vpc -s plat-ue2-dev
```

Disambiguate when the component declares more than one `kind: aws/s3` target:

```shell
atmos aws cloudformation backend create vpc -s plat-ue2-dev --target artifacts
```

## Flags

- **`--stack`, `-s` (required)**
  Atmos stack.
- **`--target` (optional)**
  The 
  `kind: aws/s3`
   provision target to use. Required when more than one is declared.
- **`--auto-approve` (optional)**
  Skip the confirmation prompt shown when the bucket already exists, since re-applying the secure defaults overwrites its existing encryption, versioning, public-access settings, and tags. Required to reconcile an existing bucket in a non-interactive session. A bucket that does not exist yet never prompts.
- **`--dry-run` (optional)**
  Resolve the component and its 
  `kind: aws/s3`
   target from static configuration and print what would happen, for example 
  `would create bucket <name> in region <region>`
  . It makes no AWS calls and does not authenticate. A component or stack that does not exist, or a component with no resolvable target, fails the same way the real run does.
- **`--identity`, `-i` (optional)**
  Atmos identity to authenticate with.

## Behavior

`backend create` resolves the component's stack configuration to find its
`kind: aws/s3` provision target(s), then provisions the bucket through the
same registered S3 backend provisioner `atmos terraform backend create` uses
— no separate backend implementation exists for CloudFormation. If the bucket
already existed, a warning explains which existing settings (versioning,
encryption, public access, tags) are being overwritten. The warning prints
before the final `Provisioned` line, so the last line reports the completed
result.