← Back to AllCode Nexus

CloudFormation Stack Reference

The AllCode Nexus CloudFormation stack deploys the minimum required infrastructure in your AWS account to enable federated Claude Code access through Amazon Bedrock.

What Gets Deployed

Core Resources (Always Created)

Resource Type Purpose
IAM OIDC Provider AWS::IAM::OIDCProvider Trusts your identity provider for federated authentication
Bedrock Access Role AWS::IAM::Role Assumed by authenticated users to invoke Bedrock models
Bedrock Access Policy AWS::IAM::Policy Scopes permissions to Bedrock model invocation only
Cognito Identity Pool AWS::Cognito::IdentityPool Maps OIDC tokens to temporary AWS credentials

Optional Resources (Monitoring Enabled)

Resource Type Purpose
CloudWatch Dashboard AWS::CloudWatch::Dashboard Real-time usage visualization
Metrics IAM Policy AWS::IAM::Policy Allows credential helper to publish usage metrics

Stack Parameters

Parameter Required Default Description
OIDCIssuerURL Yes — Your identity provider's issuer URL
OIDCClientID Yes — Application client ID from your IdP
OIDCAudience No Same as Client ID Token audience claim (if different from Client ID)
BedrockRegions No Stack region Comma-separated list of regions to allow Bedrock access
EnableMonitoring No false Deploy CloudWatch dashboard and metrics publishing
AllowedModels No All Claude models Restrict access to specific model IDs
NexusOrgID Yes Auto-filled Your Nexus organization identifier (provided by portal)

IAM Permissions Detail

The Bedrock Access Role has the following trust and permission boundaries:

Trust Policy:

Permissions Policy:

{
  "Effect": "Allow",
  "Action": [
    "bedrock:InvokeModel",
    "bedrock:InvokeModelWithResponseStream"
  ],
  "Resource": "arn:aws:bedrock:*::foundation-model/anthropic.*"
}

When monitoring is enabled, an additional statement allows:

{
  "Effect": "Allow",
  "Action": [
    "cloudwatch:PutMetricData"
  ],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "cloudwatch:namespace": "AllCodeNexus"
    }
  }
}

Deploying the Stack

From the Nexus Portal (Recommended)

  1. Go to Settings → Deployment
  2. Click Deploy Stack
  3. Fill in parameters
  4. Click Deploy

The portal launches the stack directly in your account via a CloudFormation quick-create link.

Manual Deployment

  1. Download the template from Settings → Deployment → Download Template
  2. Open the AWS CloudFormation Console
  3. Click Create stack → With new resources (standard)
  4. Upload the template file
  5. Enter the parameters
  6. Acknowledge IAM resource creation
  7. Click Create stack

Updating the Stack

When AllCode Nexus releases infrastructure updates (e.g., new model support, security patches):

  1. The Nexus portal will show an Update Available banner
  2. Go to Settings → Deployment
  3. Click Update Stack
  4. Review the changeset summary
  5. Click Apply Update

Or manually:

  1. Download the updated template from the portal
  2. In the CloudFormation console, select your stack
  3. Click Update → Replace current template
  4. Upload the new template and complete the wizard

Updates use CloudFormation changesets and will not disrupt active user sessions.

Deleting the Stack

To remove all Nexus resources from your AWS account:

  1. Open the AWS CloudFormation Console
  2. Select the AllCodeNexus stack
  3. Click Delete
  4. Confirm deletion

All IAM roles, policies, and the Cognito Identity Pool will be removed. Active user sessions will be terminated.

Note: Deleting the stack does not cancel your AWS Marketplace subscription. To cancel billing, unsubscribe from the Marketplace listing separately.

Stack Outputs

After deployment, the stack exports these values (also visible in the Nexus portal):

Output Description
BedrockRoleARN ARN of the IAM role for Bedrock access
IdentityPoolID Cognito Identity Pool identifier
OIDCProviderARN ARN of the IAM OIDC Provider
StackVersion Template version for update tracking

Multi-Region Support

To enable Bedrock access in multiple regions, set the BedrockRegions parameter to a comma-separated list:

us-east-1,us-west-2,eu-west-1

The IAM policy will scope Bedrock permissions to only the specified regions.

Next Steps