> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/aws/create-network.md).

# create-network

Create a new Rumi network (VPC) with all required networking components.

## Syntax

```bash
rumi cloud aws create-network \
  --profile <profile> \
  --name <name> \
  [options]
```

## Options

| Option                    | Short | Description                                                                                                                                                                                                             | Default                      |
| ------------------------- | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
| `--profile`               | `-p`  | AWS profile to use                                                                                                                                                                                                      | Required                     |
| `--region`                | `-r`  | AWS region                                                                                                                                                                                                              | `us-east-1`                  |
| `--name`                  | `-n`  | Name of the network (VPC)                                                                                                                                                                                               | Required                     |
| `--addr`                  | `-a`  | Network address in the form `x.y`                                                                                                                                                                                       | `10.0`                       |
| `--access-method`         | `-m`  | How operators reach this deployment's instances: `ssh`, `ssm-bastion` (close the bastion's public SSH; SSM into the bastion, then SSH on to instances), or `ssm-all` (close public SSH; SSM directly into any instance) | `ssh`                        |
| `--multi-bastion`         | `-B`  | Provision a multi-bastion network (every bastion is named and every proxying instance names its bastion); omit for a single unnamed bastion                                                                             | `false`                      |
| `--log-shipping`          | `-L`  | Create the CloudWatch Logs interface endpoint so instances ship logs to CloudWatch over a private in-VPC path (rather than via the internet gateway/NAT)                                                                | `false`                      |
| `--log-group`             | `-G`  | The CloudWatch log group instances ship their logs to; when set, every launched instance installs and configures the CloudWatch agent for its role's logs (the log group itself is supplied by you, not created)        | none (log shipping disabled) |
| `--flow-logs-destination` |       | Enable VPC Flow Logs (ALL traffic, VPC-wide) delivered to `s3` or `cloudwatch`                                                                                                                                          | none (flow logs disabled)    |
| `--flow-logs-bucket`      |       | Destination S3 bucket ARN (required when `--flow-logs-destination=s3`)                                                                                                                                                  | none                         |
| `--flow-logs-group`       |       | Destination CloudWatch log group name (required when `--flow-logs-destination=cloudwatch`)                                                                                                                              | none                         |
| `--flow-logs-role`        |       | IAM delivery role ARN flow-log delivery assumes (required when `--flow-logs-destination=cloudwatch`)                                                                                                                    | none                         |
| `--topology`              |       | Subnet topology: `public` (single public subnet) or `public-private-nat` (bastion+NAT in a small public subnet, platform+workers in a large private subnet with NAT egress)                                             | `public`                     |
| `--public-subnet-cidr`    |       | Override the public subnet CIDR (NAT topology only; in the VPC /16, non-overlapping, no smaller than /28)                                                                                                               | `<addr>.0.0/26`              |
| `--private-subnet-cidr`   |       | Override the private subnet CIDR (NAT topology only; in the VPC /16, non-overlapping, no smaller than /26)                                                                                                              | `<addr>.128.0/17`            |
| `--tag`                   | `-T`  | A tag (`key=value`) to apply to all resources created; repeatable                                                                                                                                                       | none                         |

## Example

```bash
rumi cloud aws create-network \
  --profile my-aws-profile \
  --name my-network \
  --region us-east-1
```

## Resources Created

* VPC with the chosen address range
* A single public subnet (public topology), or a small public subnet plus a large private subnet with a NAT gateway (public-private-nat topology)
* Internet Gateway
* Route tables
* S3 gateway endpoint
* Security groups
* Optional CloudWatch Logs interface endpoint (with `--log-shipping`)
* Optional VPC Flow Logs (with `--flow-logs-destination`)

## Notes

* A bastion's public proxy ports are opened on demand as instances assigned to it are launched.
* The flow-logs sink (S3 bucket, or log group plus delivery role) is supplied by you; the tool does not create it.

## See Also

* [list-networks](/rumi-cli/commands/cloud/aws/list-networks.md)
* [delete-network](/rumi-cli/commands/cloud/aws/delete-network.md)
* [launch-bastion](/rumi-cli/commands/cloud/aws/launch-bastion.md)