> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/aws/launch-bastion.md).

# launch-bastion

Provision and start a bastion. The bastion fronts the network's nginx reverse proxies and is the SSH/SSM entry point to the fleet.

## Syntax

```bash
rumi cloud aws launch-bastion \
  --profile <profile> \
  --network <network> \
  --key-pair <keypair> \
  [options]
```

## Options

| Option               | Short | Description                                                                                                                                             | Default     |
| -------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
| `--profile`          | `-p`  | AWS profile to use                                                                                                                                      | Required    |
| `--region`           | `-r`  | AWS region                                                                                                                                              | `us-east-1` |
| `--network`          | `-n`  | Name of the network to launch it into                                                                                                                   | Required    |
| `--key-pair`         | `-k`  | The network key pair                                                                                                                                    | Required    |
| `--name`             | `-b`  | The bastion name (e.g. data, ops); required in a multi-bastion network, omitted in a single-bastion network                                             | none        |
| `--jump-capable`     | `-j`  | Whether this bastion may SSH/SSM into the fleet (joins the fleet-SSH SG); a proxy-only bastion omits this                                               | `false`     |
| `--instance-profile` | `-I`  | The IAM instance profile (name or ARN) to attach; required (granting the SSM managed policy) when the network's access method is ssm-bastion or ssm-all | none        |
| `--elastic-ip`       | `-E`  | Give the bastion a stable Elastic IP (survives stop/start + replacement; reused on re-launch, released at deprovision)                                  | `false`     |

## Example

```bash
rumi cloud aws launch-bastion \
  --profile my-aws-profile \
  --network my-network \
  --key-pair my-keypair \
  --name data \
  --jump-capable
```

## Notes

In a multi-bastion network (`create-network -B`), every bastion is named and you must pass `--name`. In a single-bastion network, omit `--name` to launch the lone unnamed bastion.

Pass `--instance-profile` whenever the network uses the `ssm-bastion` or `ssm-all` access method. If you intend to run `enable-https` on this bastion, launch it with `-I` so it carries an instance profile granting Route53 access.

## See Also

* [start-bastion](/rumi-cli/commands/cloud/aws/start-bastion.md)
* [stop-bastion](/rumi-cli/commands/cloud/aws/stop-bastion.md)
* [terminate-bastion](/rumi-cli/commands/cloud/aws/terminate-bastion.md)
* [whitelist-ssh](/rumi-cli/commands/cloud/aws/whitelist-ssh.md)
* [enable-https](/rumi-cli/commands/cloud/aws/enable-https.md)