# atmos aws cloudformation backend create

Create or update the S3 bucket referenced by the component's resolved `kind:
  aws/s3` provision target, applying secure defaults: versioning enabled,
AES-256 encryption, and all four public-access-block settings enabled. If
the bucket already exists, its settings are brought in line with these
defaults rather than left as-is — this operation is idempotent, and can
safely be run again.

> ⚠️ Experimental

## Usage

```shell
atmos aws cloudformation backend create <component> --stack <stack> [options]
```

```shell
atmos aws cloudformation backend create vpc -s plat-ue2-dev
```

Disambiguate when the component declares more than one `kind: aws/s3` target:

```shell
atmos aws cloudformation backend create vpc -s plat-ue2-dev --target artifacts
```

## Flags

- **`--stack`, `-s` (required)**
  Atmos stack.
- **`--target` (optional)**
  The 
  `kind: aws/s3`
   provision target to use. Required when more than one is declared.
- **`--identity`, `-i` (optional)**
  Atmos identity to authenticate with.

## Behavior

`backend create` resolves the component's stack configuration to find its
`kind: aws/s3` provision target(s), then provisions the bucket through the
same registered S3 backend provisioner `atmos terraform backend create` uses
— no separate backend implementation exists for CloudFormation. If the bucket
already existed, a warning explains which existing settings (versioning,
encryption, public access, tags) are being overwritten.