> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kubox.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# kubox cloud bootstrap

Create the boundary and the bounded identity Kubox connects as

### Synopsis

Creates, in YOUR account, the security boundary that constrains Kubox and the
one identity it connects as: KuboxBoundary, the KuboxConnect policy, and the
KuboxConnect role carrying that boundary from the moment it exists.

THIS IS THE ONE COMMAND THAT USES YOUR ADMINISTRATOR'S AUTHORITY. It creates
the cap; everything afterwards runs inside it, as KuboxConnect, and cannot
reach back to the credentials you run this with. Kubox never creates its own
boundary, which is why this step is yours.

It does exactly what the connection's bootstrap contract says, because both
are rendered from one declaration: what the console shows you to paste is what
this runs. Run it again freely -- every step reports what it found rather than
failing on something that already exists.

```
kubox cloud bootstrap aws [flags]
```

### Options

```
      --account-id string   the account being bootstrapped; the connection's own when unset, and refused if these credentials belong elsewhere
      --connection string   the connection to bootstrap, by the id the console showed or by its name
  -h, --help                help for bootstrap
      --plan                say what would be created, and create none of it; works with -o json
      --profile string      the AWS profile to use; overrides AWS_PROFILE, so you bootstrap with the profile that has access to this account
```

### Global options

See [global options](/cli-reference/kubox#global-options).

### SEE ALSO

* [kubox cloud](/cli-reference/kubox_cloud)	 - Connect and manage the cloud accounts Kubox builds into