# atmos aws cloudformation backend update

Apply configuration changes to the S3 bucket referenced by the component's
resolved `kind: aws/s3` provision target — creating it first if it doesn't
exist yet, then bringing its versioning, encryption, and
public-access-block settings in line with Atmos's secure defaults.
`backend update` and [`backend
  create`](/cli/commands/aws/cloudformation/backend/create) dispatch through
the identical idempotent code path; `update` exists as the explicit,
intention-revealing verb for "make sure this bucket's settings are still
correct." Both commands prompt before changing an existing bucket; use
`--auto-approve` to skip this confirmation in automation.

> ⚠️ Experimental

## Usage

```shell
atmos aws cloudformation backend update <component> --stack <stack> [options]
```

```shell
atmos aws cloudformation backend update vpc -s plat-ue2-dev
```

Disambiguate when the component declares more than one `kind: aws/s3` target:

```shell
atmos aws cloudformation backend update vpc -s plat-ue2-dev --target artifacts
```

## Flags

- **`--stack`, `-s` (required)**
  Atmos stack.
- **`--target` (optional)**
  The 
  `kind: aws/s3`
   provision target to use. Required when more than one is declared.
- **`--auto-approve` (optional)**
  Skip the confirmation prompt shown when the bucket already exists, since re-applying the secure defaults overwrites its existing encryption, versioning, public-access settings, and tags. Required to reconcile an existing bucket in a non-interactive session. A bucket that does not exist yet never prompts.
- **`--dry-run` (optional)**
  Resolve the component and its 
  `kind: aws/s3`
   target from static configuration and print what would happen, without authenticating or making AWS calls. A component or stack that does not exist fails the same way the real run does.
- **`--identity`, `-i` (optional)**
  Atmos identity to authenticate with.

## Behavior

See [`backend create`](/cli/commands/aws/cloudformation/backend/create) for
the full description of what settings are applied and how the bucket already
existing is handled.