> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kubox.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# kubox admin aws bootstrap

Create the AWS resources a management plane cannot create for itself

### Synopsis

Creates the keys, the state bucket and the five IAM identities, and
checks the hosted zone. Idempotent in the sense of touch: it makes absent
things exist, leaves present ones alone, and says what it did.

Run by an administrator, once per account. NOT by CI -- creating IAM roles
requires iam:CreateRole and PutRolePolicy, which together are the ability to
grant yourself anything, and a deploy role holding those means compromising
the pipeline compromises the account. CI runs `kubox admin aws verify`, which needs
only iam:SimulatePrincipalPolicy.

Use --dry-run first. It performs every read, no writes, and prints a plan:
what must already be true, and what would change. Works on an EMPTY account,
where the policies cannot be previewed because they are scoped to keys that
do not exist yet -- the plan says which identities would be made and that
their documents are not previewable, rather than refusing.

`--dry-run -o json` is reviewable by somebody who is not at the terminal.

```
kubox admin aws bootstrap [flags]
```

### Options

```
      --allow-region stringArray    a region these identities may act in; repeatable (default: --region alone)
      --artifact-key string         KMS key ARN protecting sealed artifacts; the runner writes it, the unsealer reads it
      --artifact-key-alias string   KMS alias for the key that seals artifacts; created if absent (default "alias/kubox-artifacts")
      --ci-role string              GitHub OIDC role that builds the plane's own cluster on day zero (trust policy only)
      --dry-run                     read everything, write nothing, and print the plan; works with -o json
      --external-id string          binds a target-account role to one tenant (trust policy only)
  -h, --help                        help for bootstrap
      --hosted-zone string          Route53 zone the build may publish records in
      --operator stringArray        ARN of a user or role that may assume the build role directly, for a laptop build; repeatable (trust policy only)
      --plane-account string        AWS account the management plane runs in
      --region string               primary region, substituted into resource ARNs
      --root-domain string          domain the plane serves; its hosted zone is what the DNS grant is scoped to
      --stack-key string            KMS key ARN protecting the Pulumi checkpoint; the build both writes and reads it
      --stack-key-alias string      KMS alias for the key that encrypts Pulumi state; must be a different key (default "alias/kubox-stacks")
      --state-backend string        Pulumi state backend, e.g. s3://bucket/prefix
      --target-account string       AWS account a cluster is built into (default: the plane's own)
      --tenant stringArray          a tenant the artifact roles seal for: the cloud connection's namespace (kubox-system for Kubox's own account); repeatable, and required for the tenant artifact identities
      --workload-issuer string      the identity plane's issuer, e.g. https://oidc-exp.kubox.cloud; required
```

### Global options

See [global options](/cli-reference/kubox#global-options).

### SEE ALSO

* [kubox admin aws](/cli-reference/kubox_admin_aws)	 - Render and verify the IAM policies a Kubox deployment needs