> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/aws/provision.md).

# provision

Single-bastion convenience: provisions a complete Rumi private cloud on AWS, the network plus platform (bastion, Admin, Monitor) plus at most one broker, all proxying through the lone bastion, with one instance profile for every platform/broker instance.

## Syntax

```bash
rumi cloud aws provision \
  --profile <profile> \
  --name <name> \
  --key-pair <keypair> \
  [options]
```

## Options

| Option                     | Short | Description                                                                                                                                                      | Default        |
| -------------------------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------- |
| `--profile`                | `-p`  | AWS profile to use                                                                                                                                               | Required       |
| `--region`                 | `-r`  | AWS region                                                                                                                                                       | `us-east-1`    |
| `--name`                   | `-n`  | Name of the private cloud                                                                                                                                        | Required       |
| `--addr`                   | `-h`  | Address of the private cloud's network in the form `x.y`                                                                                                         | `10.0`         |
| `--key-pair`               | `-k`  | The network's EC2 key pair                                                                                                                                       | Required       |
| `--message-broker`         | `-m`  | Messaging broker to provision (`solace`, `kafka`, `activemq`)                                                                                                    | none           |
| `--admin-proxy-server`     | `-a`  | The admin proxy server (nginx `server_name` on the bastion)                                                                                                      | `null`         |
| `--admin-proxy-port`       | `-b`  | The admin proxy port the bastion's nginx listens on                                                                                                              | `0` (no proxy) |
| `--discovery-proxy-server` | `-c`  | The discovery proxy server (nginx `server_name` on the bastion)                                                                                                  | `null`         |
| `--discovery-proxy-port`   | `-d`  | The discovery proxy port the bastion's nginx listens on                                                                                                          | `0` (no proxy) |
| `--monitor-proxy-server`   | `-e`  | The monitor proxy server (nginx `server_name` on the bastion)                                                                                                    | `null`         |
| `--monitor-proxy-port`     | `-f`  | The monitor proxy port the bastion's nginx listens on                                                                                                            | `0` (no proxy) |
| `--broker-proxy-server`    | `-g`  | The broker proxy server (nginx `server_name` on the bastion)                                                                                                     | `null`         |
| `--broker-proxy-port`      | `-i`  | The broker proxy port the bastion's nginx listens on                                                                                                             | `0` (no proxy) |
| `--access-method`          | `-M`  | How operators reach this deployment's instances: `ssh`, `ssm-bastion`, or `ssm-all`                                                                              | `ssh`          |
| `--instance-profile`       | `-I`  | The IAM instance profile (name or ARN) applied to the platform and broker instances; required (granting the SSM managed policy) under `ssm-bastion` or `ssm-all` | `null`         |

## Example

```bash
rumi cloud aws provision \
  --profile my-aws-profile \
  --name my-cloud \
  --key-pair my-keypair \
  --message-broker solace
```

## What it does

1. Creates the network infrastructure (VPC, subnet, security groups, Route 53 hosted zone).
2. Launches the bastion and configures it as the proxy front.
3. Launches the Admin and Monitor services and, if requested, the message broker (Solace, Kafka, or ActiveMQ).
4. Registers DNS entries for each service in the hosted zone.
5. Configures nginx reverse-proxy entries on the bastion for any of the platform services whose `--*-proxy-server` / `--*-proxy-port` flags are set.

## Notes

* For multi-bastion topologies, per-service proxy-bastion routing, multiple brokers, or service instances, use the granular [create-network](/rumi-cli/commands/cloud/aws/create-network.md) and `launch-*` commands.

## See Also

* [deploy](/rumi-cli/commands/cloud/aws/deploy.md)
* [start](/rumi-cli/commands/cloud/aws/start.md)
* [stop](/rumi-cli/commands/cloud/aws/stop.md)
* [deprovision](/rumi-cli/commands/cloud/aws/deprovision.md)