# atmos aws cloudformation backend create

Create the template-packaging bucket or reapply its settings. Atmos enables
versioning, AES-256 encryption, and all public-access-block settings.

> ⚠️ Experimental

**CloudFormation Configuration**

Configure templates, parameters, and delivery targets for your component.
Configuration Reference[Read more](/stacks/components/aws-cloudformation#delivery-targets)

## Usage

```shell
atmos aws cloudformation backend create <component> --stack <stack> [options]
```

## Examples

```shell
atmos aws cloudformation backend create vpc -s plat-ue2-dev
```

Disambiguate when the component declares more than one `kind: aws/s3` target:

```shell
atmos aws cloudformation backend create vpc -s plat-ue2-dev --target artifacts
```

## Arguments

- **`component` (required)**
  CloudFormation component name in the Atmos stack.

## Flags

- **`--stack`, `-s` (required)**
  Atmos stack.
- **`--target` (optional)**
  The 
  `kind: aws/s3`
   provision target to use. Required when more than one is declared.
- **`--auto-approve` (optional)**
  Skip the confirmation prompt shown when the bucket already exists, since re-applying the secure defaults overwrites its existing encryption, versioning, public-access settings, and tags. Required to reconcile an existing bucket in a non-interactive session. A bucket that does not exist yet never prompts.
- **`--dry-run` (optional)**
  Resolve the component and its 
  `kind: aws/s3`
   target from static configuration and print what would happen, for example 
  `would create bucket <name> in region <region>`
  . It makes no AWS calls and does not authenticate. A component or stack that does not exist, or a component with no resolvable target, fails the same way the real run does.
- **`--identity`, `-i` (optional)**
  Atmos identity to authenticate with.

## Behavior

For an existing bucket, Atmos asks for confirmation before reapplying versioning,
encryption, public-access blocking, and tags. Use `--auto-approve` in CI.
A new bucket does not require confirmation.

The existence check and provisioning use the same target identity. The command
reports the settings being overwritten before printing the completion message.