> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/aws.md).

# aws

The `rumi cloud aws` commands provision and manage Rumi private clouds in Amazon Web Services (AWS).

## Overview

AWS commands provide complete lifecycle management for Rumi private clouds:

* **Network Infrastructure** - Create and manage VPCs, subnets, security groups, and the subnet topology (single public subnet, or public + private + NAT)
* **Access Posture** - Choose how operators reach instances (SSH via the bastion, or AWS Systems Manager / SSM)
* **DNS Management** - Set up hosted zones for private cloud domains
* **Platform Services** - Deploy Bastion, Admin, Monitor, and messaging services
* **Bastion Access & Security** - Open service ports and SSH to specific CIDRs, and enable HTTPS with a Let's Encrypt wildcard certificate
* **Observability** - Ship instance logs to CloudWatch and enable VPC Flow Logs
* **Application Deployment** - Deploy and manage your Rumi applications
* **Lifecycle Management** - Provision, start, stop, resize, and deprovision entire clouds

## Prerequisites

Before using AWS commands, you must:

1. **Install the AWS CLI** - Version 2.x required
2. **Configure AWS credentials** - See [AWS Setup](/rumi-cli/installation/aws-setup.md) for detailed instructions
3. **Have appropriate IAM permissions** - EC2 and Route53 access required

## Commands

### Network Management

| Command                                                          | Description                     |
| ---------------------------------------------------------------- | ------------------------------- |
| [create-network](/rumi-cli/commands/cloud/aws/create-network.md) | Create a new Rumi network (VPC) |
| [list-networks](/rumi-cli/commands/cloud/aws/list-networks.md)   | List all Rumi networks          |
| [delete-network](/rumi-cli/commands/cloud/aws/delete-network.md) | Delete a Rumi network           |

### DNS Management

| Command                                                    | Description          |
| ---------------------------------------------------------- | -------------------- |
| [create-zone](/rumi-cli/commands/cloud/aws/create-zone.md) | Create a hosted zone |
| [list-zones](/rumi-cli/commands/cloud/aws/list-zones.md)   | List hosted zones    |

### Bastion

The bastion fronts the network's nginx reverse proxies and is the SSH/SSM entry point to the fleet. A network is single-bastion (one unnamed bastion) or multi-bastion (`create-network -B`; every bastion is named and every proxying instance names the bastion that fronts it).

| Command                                                                | Description                           |
| ---------------------------------------------------------------------- | ------------------------------------- |
| [launch-bastion](/rumi-cli/commands/cloud/aws/launch-bastion.md)       | Provision and start a bastion         |
| [start-bastion](/rumi-cli/commands/cloud/aws/start-bastion.md)         | Start a bastion                       |
| [stop-bastion](/rumi-cli/commands/cloud/aws/stop-bastion.md)           | Stop a bastion                        |
| [terminate-bastion](/rumi-cli/commands/cloud/aws/terminate-bastion.md) | Remove a bastion                      |
| [add-proxy](/rumi-cli/commands/cloud/aws/add-proxy.md)                 | Add an nginx proxy entry on a bastion |

### Bastion Access & Security

A launch records a service's public proxy port but opens nothing. Opening is a separate, deliberate step scoped to specific source CIDRs (the `my-ip` token resolves to your own public IP).

| Command                                                            | Description                                                               |
| ------------------------------------------------------------------ | ------------------------------------------------------------------------- |
| [whitelist](/rumi-cli/commands/cloud/aws/whitelist.md)             | Open an instance's recorded proxy port(s) on its bastion for given CIDRs  |
| [unwhitelist](/rumi-cli/commands/cloud/aws/unwhitelist.md)         | Revoke an instance's proxy port(s) for given CIDRs                        |
| [whitelist-ssh](/rumi-cli/commands/cloud/aws/whitelist-ssh.md)     | Open a bastion's SSH (TCP 22) for given CIDRs (ssh access method only)    |
| [unwhitelist-ssh](/rumi-cli/commands/cloud/aws/unwhitelist-ssh.md) | Revoke a bastion's SSH for given CIDRs                                    |
| [enable-https](/rumi-cli/commands/cloud/aws/enable-https.md)       | Issue a Let's Encrypt wildcard certificate and terminate TLS on a bastion |

### Admin Service

| Command                                                              | Description                       |
| -------------------------------------------------------------------- | --------------------------------- |
| [launch-admin](/rumi-cli/commands/cloud/aws/launch-admin.md)         | Provision and start Admin service |
| [start-admin](/rumi-cli/commands/cloud/aws/start-admin.md)           | Start Admin service               |
| [stop-admin](/rumi-cli/commands/cloud/aws/stop-admin.md)             | Stop Admin service                |
| [terminate-admin](/rumi-cli/commands/cloud/aws/terminate-admin.md)   | Remove Admin service              |
| [run-admin-script](/rumi-cli/commands/cloud/aws/run-admin-script.md) | Execute an admin script           |

### Monitor Service

| Command                                                                | Description                         |
| ---------------------------------------------------------------------- | ----------------------------------- |
| [launch-monitor](/rumi-cli/commands/cloud/aws/launch-monitor.md)       | Provision and start Monitor service |
| [start-monitor](/rumi-cli/commands/cloud/aws/start-monitor.md)         | Start Monitor service               |
| [stop-monitor](/rumi-cli/commands/cloud/aws/stop-monitor.md)           | Stop Monitor service                |
| [terminate-monitor](/rumi-cli/commands/cloud/aws/terminate-monitor.md) | Remove Monitor service              |

### Message Brokers

| Command                                                              | Description                  |
| -------------------------------------------------------------------- | ---------------------------- |
| [launch-solace](/rumi-cli/commands/cloud/aws/launch-solace.md)       | Provision and start Solace   |
| [start-solace](/rumi-cli/commands/cloud/aws/start-solace.md)         | Start Solace                 |
| [stop-solace](/rumi-cli/commands/cloud/aws/stop-solace.md)           | Stop Solace                  |
| [terminate-solace](/rumi-cli/commands/cloud/aws/terminate-solace.md) | Remove Solace                |
| [launch-kafka](/rumi-cli/commands/cloud/aws/launch-kafka.md)         | Provision and start Kafka    |
| [start-kafka](/rumi-cli/commands/cloud/aws/start-kafka.md)           | Start Kafka                  |
| [stop-kafka](/rumi-cli/commands/cloud/aws/stop-kafka.md)             | Stop Kafka                   |
| [terminate-kafka](/rumi-cli/commands/cloud/aws/terminate-kafka.md)   | Remove Kafka                 |
| [launch-amq](/rumi-cli/commands/cloud/aws/launch-amq.md)             | Provision and start ActiveMQ |
| [start-amq](/rumi-cli/commands/cloud/aws/start-amq.md)               | Start ActiveMQ               |
| [stop-amq](/rumi-cli/commands/cloud/aws/stop-amq.md)                 | Stop ActiveMQ                |
| [terminate-amq](/rumi-cli/commands/cloud/aws/terminate-amq.md)       | Remove ActiveMQ              |

### Platform

| Command                                                                  | Description                  |
| ------------------------------------------------------------------------ | ---------------------------- |
| [launch-platform](/rumi-cli/commands/cloud/aws/launch-platform.md)       | Provision and start platform |
| [start-platform](/rumi-cli/commands/cloud/aws/start-platform.md)         | Start platform               |
| [stop-platform](/rumi-cli/commands/cloud/aws/stop-platform.md)           | Stop platform                |
| [terminate-platform](/rumi-cli/commands/cloud/aws/terminate-platform.md) | Remove platform              |

### Instance Management

| Command                                                                  | Description                                                  |
| ------------------------------------------------------------------------ | ------------------------------------------------------------ |
| [launch-instance](/rumi-cli/commands/cloud/aws/launch-instance.md)       | Launch an EC2 instance                                       |
| [start-instance](/rumi-cli/commands/cloud/aws/start-instance.md)         | Start an instance                                            |
| [stop-instance](/rumi-cli/commands/cloud/aws/stop-instance.md)           | Stop an instance                                             |
| [terminate-instance](/rumi-cli/commands/cloud/aws/terminate-instance.md) | Terminate an instance                                        |
| [resize-instance](/rumi-cli/commands/cloud/aws/resize-instance.md)       | Change a running instance's EC2 instance type                |
| [resize-volume](/rumi-cli/commands/cloud/aws/resize-volume.md)           | Grow a running instance's root or data (`/home/rumi`) volume |
| [list-instances](/rumi-cli/commands/cloud/aws/list-instances.md)         | List all instances                                           |
| [attach-volume](/rumi-cli/commands/cloud/aws/attach-volume.md)           | Attach an EBS volume                                         |
| [run-command](/rumi-cli/commands/cloud/aws/run-command.md)               | Execute a command on an instance                             |

### High-Level Lifecycle

| Command                                                    | Description                        |
| ---------------------------------------------------------- | ---------------------------------- |
| [provision](/rumi-cli/commands/cloud/aws/provision.md)     | Provision a complete private cloud |
| [deploy](/rumi-cli/commands/cloud/aws/deploy.md)           | Deploy an application              |
| [configure](/rumi-cli/commands/cloud/aws/configure.md)     | Configure an application           |
| [start](/rumi-cli/commands/cloud/aws/start.md)             | Start all services                 |
| [stop](/rumi-cli/commands/cloud/aws/stop.md)               | Stop all services                  |
| [deprovision](/rumi-cli/commands/cloud/aws/deprovision.md) | Remove a private cloud             |

## Common Options

Most AWS commands support these common options:

| Option          | Description                           |
| --------------- | ------------------------------------- |
| `-p, --profile` | AWS profile to use (required)         |
| `-r, --region`  | AWS region (default: us-east-1)       |
| `-n, --name`    | Name of the resource or private cloud |

## Typical Workflow

```bash
# 1. Provision a complete private cloud (single-bastion convenience)
rumi cloud aws provision \
  --profile my-aws-profile \
  --name my-cloud \
  --addr 10.0 \
  --key-pair my-keypair \
  --message-broker solace

# 2. Deploy your application
rumi cloud aws deploy \
  --profile my-aws-profile \
  --name my-cloud \
  --xar my-app.xar

# 3. Start all services
rumi cloud aws start --profile my-aws-profile --name my-cloud

# 4. Stop when not in use (saves costs)
rumi cloud aws stop --profile my-aws-profile --name my-cloud

# 5. Clean up when done
rumi cloud aws deprovision --profile my-aws-profile --name my-cloud
```

## Related Documentation

* [**AWS Setup**](/rumi-cli/installation/aws-setup.md) - Configure AWS CLI and credentials
* [**Local Commands**](/rumi-cli/commands/cloud/local.md) - Docker-based local deployments
* [**Installation**](/rumi-cli/installation.md) - Install the Rumi CLI